Microsoft Defender patch may allow disk space exhaustion

Microsoft released a patch on Wednesday to address a zero-day vulnerability in its Defender security engine. However, the researcher who discovered the flaw, operating under the pseudonym NightmareEclipse, stated that the update may inadvertently create a new issue where attackers could fill hard drives by writing files of unlimited size.

The vulnerability, tracked as CVE-2026-50656 and named RoguePlanet, was publicly disclosed in June along with exploit code. It allowed remote attackers to gain administrative control over Windows 10 and Windows 11 machines, even with real-time protection disabled.

Microsoft's update targets the Microsoft Malware Protection Engine, which is integral to the Defender antivirus application. The fix is designed to download and install automatically. However, NightmareEclipse noted that new 'defense-in-depth' updates within the patch introduce a problem in mpengine.dll, the driver for the protection engine. This issue can cause the driver to leak 8 bytes of data when attempting to open a file. Additionally, new functionality in SpyNet, a Microsoft cloud service for reporting suspicious software, contributes to the potential for mass file-writing.

Normally, Defender enforces strict limits on file sizes during scanning and quarantining to prevent disk space exhaustion. NightmareEclipse observed that the SpyNet functions in mpengine.dll appear to bypass these limits, attempting to cache a local copy of the Zone.Identifier ADS file regardless of its size, potentially leading to complete consumption of available disk space.