New Unpatched Tool Can Silently Stop Microsoft Defender Updates

A security researcher has released a proof-of-concept tool on GitHub called BigDiskBuster that prevents Microsoft Defender from installing platform and signature updates. There is no patch, CVE, or Microsoft advisory for the issue. The tool works by watching for Defender update activity, then filling all remaining free disk space with a hidden file so the update process fails. Defender continues to run, but its threat detection data can become outdated over time.

The tool's author, Abdelhamid Naceri, is a former Microsoft security researcher who says he has been releasing Defender and Windows exploits without coordinating with Microsoft since being dismissed from the company in 2024. Three of his earlier Defender tools were exploited in real attacks before Microsoft patched them, and all three were added to CISA's Known Exploited Vulnerabilities catalog. Naceri compares BigDiskBuster to an earlier flaw he found called UnDefend, which Microsoft patched in May, but the two use different techniques, so it is unclear whether that fix also protects against this new method.

Naceri has described BigDiskBuster as still buggy, and no independent researcher has yet confirmed exactly how it behaves across different Windows versions. Because there is currently no vendor fix, businesses relying solely on Microsoft Defender should be aware that its update mechanism could potentially be disrupted through this technique.