BigDiskBuster — public PoC that can block Microsoft Defender updates by filling the disk

On September 19, a tool called BigDiskBuster was published on GitHub — a proof of concept designed to block platform and signature updates for Microsoft Defender. According to the source material, there is no patch, CVE identifier, or Microsoft recommendations for this technique. The tool fills up disk space to prevent Defender from downloading updates — the antivirus keeps running, but its detection database becomes outdated. At the time of publication, there is no independent confirmation of the claimed behavior.

How BigDiskBuster works

Analysis of the source code shows that the tool monitors activity in two hard-coded directories — the Windows Defender platform and definition update directories (paths like ProgramData\\Microsoft\\Windows Defender\\Platform\\ and a similar one for definitions). When Defender starts downloading an update and creates a new subdirectory, BigDiskBuster reacts as follows:

• Determines the amount of free space on volume C:\\ (the volume is hard-coded in the source).
• Creates a hidden temporary file whose size equals all available free space, with the delete-on-close flag (FILE_DELETE_ON_CLOSE).
• The Defender update fails due to insufficient disk space.
• After detecting the update failure, the tool deletes the temporary file, frees the space, and goes back to waiting for the next attempt.

Additionally, the code attempts to open the MRT.exe file (Windows Malicious Software Removal Tool) with restricted sharing flags, which, according to the description, should prevent Windows Update from replacing this file. However, the code only shows an attempt to block it — actual prevention of file replacement via Windows Update has not been independently confirmed.

An important technical detail: the implementation is tied to a specific volume (C:\\) and specific Defender update paths. The repository’s claim of compatibility “with all supported versions of Windows” remains unverified and should not be generalized beyond the demonstrated configuration. The author themself describes the code as “a bit buggy and in need of work.”

Relationship to CVE-2026-45498 and earlier tools

The author describes BigDiskBuster as a tool “similar to UnDefend” — a previously disclosed Defender denial-of-service vulnerability that blocked definition updates using a different method. Microsoft fixed UnDefend in May 2026, assigning it the identifier CVE-2026-45498 in Antimalware Platform version 4.18.26040.7. This vulnerability was added to the CISA KEV catalog on May 20, 2026, with a remediation deadline of June 3, 2026.

However, the mechanisms of the two tools differ: UnDefend relied on uncontrolled resource consumption, whereas BigDiskBuster fills disk space, preventing Defender update directories from growing. Whether the May patch for CVE-2026-45498 covers the BigDiskBuster technique has not been established, and the difference in mechanisms suggests that it most likely does not. There is no explicit Microsoft position on BigDiskBuster in the available materials.

We have already written about CVE-2026-45498 and related Defender vulnerabilities — in particular, about the exploitation of CVE-2026-41091 and CVE-2026-45498, as well as about the conflict between Microsoft and the researcher who disclosed zero-day vulnerabilities.

Impact assessment

The impact demonstrated by BigDiskBuster is limited to disrupting the Defender update process. This is not a remote code execution vulnerability and not a direct system compromise. Nevertheless, the consequences can be serious: an antivirus with outdated signatures and platform fails to detect new threats, creating a window for attacks using fresh malware.

To use the tool, arbitrary code execution on the target system is required — that is, the attacker must already have a certain level of access. BigDiskBuster is more of a post-exploitation tool that weakens defenses before deploying the main payload.

Active exploitation of this specific technique has not been recorded at the time of publication. However, the public availability of the PoC and the history of the author’s previous tools, which, according to the source material, were used in real attacks before patches were released, make the threat practically significant.

Detection and protection recommendations

There is no patch or official vendor workaround for BigDiskBuster. However, analysis of the source code makes it possible to formulate specific monitoring indicators that are more precise than generic tracking of low disk space:

• Monitoring Defender update directories: track creation and deletion activity for subdirectories in the Platform and Definition Updates directories under ProgramData\\Microsoft\\Windows Defender\\ followed by the appearance of large hidden files.
• Hidden temporary files: pay attention to files created with the FILE_ATTRIBUTE_HIDDEN attribute and the FILE_DELETE_ON_CLOSE flag whose size approaches the volume’s free space.
• Blocking MRT.exe: log attempts to open Windows\\System32\\MRT.exe with restricted sharing flags.
• Repeated update failures: configure alerts for systematic Defender update failures, especially if combined with short-term filling of the system volume.
• Checking currency: in PowerShell, the Get-MpComputerStatus command shows current versions in the AMEngineVersion and AMProductVersion fields.
• Execution restrictions: WDAC or AppLocker policies that block execution of unknown binaries reduce the likelihood of launching such tools.

Organizations that use Microsoft Defender as their primary endpoint protection tool should immediately verify the currency of platform and signature versions on all managed systems and configure monitoring for the listed indicators. Given the lack of a patch, the key measure is to restrict execution of unauthorized programs via WDAC or AppLocker, which blocks the ability to run BigDiskBuster and similar tools on protected hosts.