Home / Technology / Defender Patch Causes Disk Space Catastrophe
Defender Patch Causes Disk Space Catastrophe
10 Jul
Summary
- Microsoft Defender patch may cause unlimited file writes.
- Vulnerability allows remote attackers administrative control.
- Researcher warns of potential disk space exhaustion.
Microsoft released a patch on Wednesday, July 10, 2026, to address a critical zero-day vulnerability in its Defender security engine. The vulnerability, known as RoguePlanet (CVE-2026-50656), was disclosed in June with exploit code, allowing remote attackers to gain administrative control of Windows 10 and 11 systems.
However, the researcher who discovered the flaw, using the pseudonym NightmareEclipse, warned that new "defense-in-depth" updates within the patch could inadvertently cause Defender to write files of unlimited size. This behavior may lead to attackers completely consuming a hard drive's available space by writing excessive data.
This potential issue stems from how the updated Malware Protection Engine handles Zone.Identifier files, which are metadata files associated with internet-downloaded content. The researcher detailed a method where a custom SMB server could exploit this by holding connections open, causing Defender to lock files and fill the disk.
Microsoft has not immediately confirmed the existence of this behavior. This situation occurs amidst an ongoing dispute between NightmareEclipse and Microsoft regarding vulnerability disclosures and patching practices.
