New BigDiskBuster zero-day cuts off Windows Defender updates

Over the weekend, security researcher Abdelhamid Naceri, who also goes by Nightmare Eclipse, released a new Microsoft Defender zero-day exploit. Dubbed BigDiskBuster by its author, the tool blocks updates to the built-in Windows antivirus.

Naceri says BigDiskBuster is mechanically similar to UnDefend, a flaw he disclosed in April that let standard users without admin rights stop virus-definition downloads. The new exploit works on all supported Windows versions, but it has to keep running in the background to hold updates at bay.

"Made a funny tool, completely denies Defender from updating so you're stuck with your current version if the tool is running in the background," the researcher wrote. He candidly noted that the proof of concept is still rough, a bit buggy, and needs rewriting — "but you get the idea."

A long-running dispute with Microsoft

BigDiskBuster is far from Naceri's first shot. Since April 2026 he has published nearly a dozen zero-day exploits as part of a feud with Microsoft, which he accuses of unfairly firing him in March 2025. Just two weeks ago, right after September's Patch Tuesday, he released another Defender exploit — ShieldCrash — that grants SYSTEM access.

By his account, ShieldCrash bypasses ShieldBreak, patched a week earlier, which in turn bypassed RoguePlanet, a June flaw Microsoft fixed in July. His finds this year also include LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, targeting Microsoft Defender, BitLocker, and other Windows components.

Microsoft initially responded with warnings of legal action against anyone engaged in "malicious activity causing real harm" to its customers — language many in the infosec community read as a direct threat to the researcher. The company has since fixed some of the reported flaws (ShieldBreak, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma), but the rest still lack an official patch.

A Microsoft spokesperson was not immediately available when BleepingComputer asked about the new denial-of-service zero-day.

Source: Bleeping Computer