A new proof-of-concept called BigDiskBuster has been released by security researcher Abdelhamid Naceri, also known as Nightmare Eclipse. The tool targets the Microsoft Defender Antivirus update mechanism rather than directly disabling Defender.
What does BigDiskBuster do?
BigDiskBuster is designed to prevent Microsoft Defender from completing its platform and security intelligence updates.
The PoC waits for a Defender update to begin and then attempts to consume the system drive’s available free space using temporary files. This can cause the update operation to fail. After detecting the failure, the tool releases the occupied space.
The PoC also interacts with MRT.exe, Microsoft’s Malicious Software Removal Tool, by keeping a restrictive file handle open.
Defender itself remains running
This is an important distinction.
BigDiskBuster does not simply turn off Microsoft Defender. The antivirus can continue running, but its platform and security intelligence versions may remain unchanged while the PoC continues interfering with updates.
That means the endpoint could have Defender enabled while running with older detection intelligence.
Current status
- Name: BigDiskBuster
- Type: Proof-of-concept / Defender update denial-of-service
- Researcher: Abdelhamid Naceri / Nightmare Eclipse
- Target: Microsoft Defender Antivirus
- Impact: Blocks platform and security-intelligence updates
- Published: September 2026
- CVE: No CVE assigned as of September 24, 2026
- Microsoft patch: No specific patch announced in the sources reviewed
- Exploit availability: Public PoC
- Real-world exploitation: No evidence reported so far
- PoC status: Researcher says it is still buggy and needs rewriting
- Compatibility: Researcher claims all supported Windows versions, but this has not been independently verified.
What defenders should check
The immediate operational check is simple:
Don’t only verify that Defender is enabled. Verify that Defender is successfully updating.
Monitor for:
- Repeated Defender update failures
- Unexpected disk-space exhaustion
- Defender security intelligence becoming stale
- Suspicious temporary-file activity during Defender updates
- Unusual activity involving Defender update components or
MRT.exe
A Defender update error such as 0x80070643 is not, by itself, proof of BigDiskBuster because it is a generic installation error.
The key takeaway
BigDiskBuster doesn’t necessarily stop Defender from running. It attempts to stop Defender from staying current.
That makes the core issue straightforward:
Defender can be enabled, but its protection intelligence can become stale if updates are continuously prevented.
As of September 24, 2026, this remains a public PoC with no assigned CVE or announced Microsoft-specific fix, rather than evidence of widespread exploitation.
