New BigDiskBuster Zero-Day Can Block Microsoft Defender Updates

BigDiskBuster Microsoft Defender zero-day is a new proof-of-concept exploit that can stop Defender from downloading platform and signature updates.

Security researcher Nightmare Eclipse, also known as Naceri, released BigDiskBuster and says it works across all supported Windows versions.

BigDiskBuster can block Microsoft Defender updates

The exploit prevents Microsoft Defender from downloading new platform and security intelligence updates while it runs in the background.

As a result, Defender remains stuck on the signatures already installed on the system. The antivirus itself continues running, but it cannot receive newer definitions needed to detect recently identified threats.

Naceri says the current BigDiskBuster proof of concept remains buggy and needs additional rewriting.

Microsoft had not announced a patch for the vulnerability at the time of publication.

BigDiskBuster follows the earlier UnDefend zero-day

BigDiskBuster works similarly to UnDefend, another Microsoft Defender vulnerability Naceri disclosed in April 2026.

UnDefend could also stop Defender definition updates, including from a standard Windows user account.

Both vulnerabilities target Defender’s update mechanism rather than shutting down every antivirus protection feature.

The same researcher previously released the ShieldCrash zero-day, which remains unpatched.

In other Microsoft news, the company is again urging Entra ID users to switch to passkeys, while Microsoft has also fixed the recent Excel copy-and-paste issue.

Via BleepingComputer