Windows Defender zero-day patch could cause hard drive to fill up
Microsoft's Wednesday patch for a critical Windows Defender zero-day vulnerability may inadvertently cause the antivirus engine to write unlimited data, exhausting available disk space, according to the researcher who found the flaw.
A patch Microsoft released on Wednesday to fix a zero-day vulnerability in its Defender security engine may cause Windows machines to write files large enough to completely consume available disk space, the researcher who discovered the flaw said. The vulnerability, tracked as CVE-2026-50656 and dubbed RoguePlanet, was disclosed in June by a researcher using the pseudonym NightmareEclipse, along with exploit code. It allowed remote attackers to gain administrative control over Windows 10 and Windows 11 machines, even when real-time protection was disabled.
Microsoft said Wednesday that it patched RoguePlanet with an update to the Microsoft Malware Protection Engine, automatically downloaded and installed. The update also includes “defense-in-depth updates to help improve security-related features.” However, in a Thursday post, NightmareEclipse reported that these mitigations cause behavior that may allow attackers to exhaust all hard drive space by writing massive amounts of data.
The newly introduced mitigations create a problem in mpengine.dll, the driver associated with the Microsoft Malware Protection Engine, that in some cases causes it to leak 8 bytes of data when trying to open a file. New functionality in SpyNet, a cloud service that collects reports about suspicious software, also plays a role. Defender normally places hard limits on file size during scanning and quarantining. NightmareEclipse found an exception: the SpyNet functions in mpengine.dll insist on keeping a local copy of the Zone.Identifier ADS file regardless of its size, leading to unlimited disk writes.
Over the past few months, the anonymous researcher has published several other zero-days that have pressed Microsoft to develop patches quickly. Users are advised to ensure their Defender updates are current and to monitor free disk space.
