Microsoft's Defender patch may let attackers fill your hard drive

Microsoft recently issued a patch for a zero-day vulnerability in its Windows Defender security engine tracked as CVE-2026-50656 (RoguePlanet). Discovered by the pseudonymous researcher NightmareEclipse, the flaw allowed remote attackers to gain administrative control of Windows 10 and 11 machines even with real-time protection disabled. The patch was delivered via an update to the Microsoft Malware Protection Engine (mpengine.dll) and automatically installed. However, NightmareEclipse now claims that the patch introduces a new attack vector: defense-in-depth mitigations that inadvertently cause Defender to write files of unlimited size, potentially exhausting all available disk space on a machine.

The issue stems from a small 8-byte leak in mpengine.dll when it attempts to open a file, combined with new functionality in Microsoft's SpyNet cloud service. Normally, Defender limits the size of files it writes during scanning and quarantine, but the researcher found an exception: SpyNet functions in mpengine.dll will cache a local copy of a Zone.Identifier ADS file regardless of its size. Zone.Identifier is a hidden metadata stream Windows uses to mark file origins (e.g., downloaded from the internet). A malicious actor can trigger this behavior using a custom SMB server that serves a malicious file followed by a massive ADS. By never responding to read requests but keeping the connection alive, Defender will hang and keep a lock on the file, writing unlimited data and filling the disk. This causes system instability as apps and services crash randomly. The feud between NightmareEclipse and Microsoft continues, with the researcher claiming Microsoft silently patched a prior report without credit, leading to public disclosures.