A new zero-day exploit targeting Windows Defender has been released, allowing malicious actors to block antivirus updates and leave users vulnerable to attacks. The exploit, dubbed BigDiskBuster, was created by Abdelhamid Naceri, a security researcher who has been at odds with Microsoft over their alleged unfair termination last year.
Naceri’s tool works on all supported Windows versions and must run in the background to block Defender updates. According to the researcher, it is similar to another Defender zero-day exploit he released earlier this year, UnDefend, which allowed standard users to block definition updates. The new exploit has sparked concerns among security experts, who fear that it could be used by attackers to disable antivirus protection and leave systems open to malware and other types of cyber threats.
This latest development is part of an ongoing dispute between Naceri and Microsoft, who have been at odds since the researcher’s termination in March 2025. Since then, Naceri has released several zero-day exploits targeting various Windows components, including Defender, BitLocker, and others. Some of these exploits have been patched by Microsoft, but others remain unaddressed.
The most concerning aspect of this situation is that some of the security flaws disclosed by Naceri still lack an official patch from Microsoft. For example, the ShieldBreak privilege escalation flaw was patched just a week ago, but another related exploit, ShieldCrash, was released two weeks ago and grants SYSTEM access right after Patch Tuesday security updates are applied.
Microsoft has issued warnings against engaging in “malicious activity causing real harm” to their customers, leading some to believe that the company is directly threatening Naceri. However, a Microsoft spokesperson declined to comment on the BigDiskBuster denial-of-service zero-day when reached out by BleepingComputer.
The release of BigDiskBuster highlights the ongoing vulnerability of Windows Defender to exploits and underscores the need for users to remain vigilant in updating their antivirus software regularly. While Naceri’s tools are proof-of-concepts, they demonstrate how easily an attacker could use similar techniques to disable antivirus protection and compromise system security.
In light of this development, it is essential for users to prioritize regular updates and maintenance of their antivirus software, including Windows Defender. This includes ensuring that the tool is running in the background and allowing definition updates to be applied without interference. By taking these precautions, users can minimize their risk exposure to potential attacks and maintain a secure computing environment.
Source: Bleeping Computer — 2026-09-22