BleepingComputer (Sergiu Gatlan; coverage of weekend disclosure) reports security researcher Abdelhamid Naceri (MSNightmare / Nightmare Eclipse) released BigDiskBuster, a local proof-of-concept that prevents Microsoft Defender Antivirus from completing platform and security-intelligence updates while it runs. The tool watches Defender Platform/Definition Updates directories on the C: volume and starves the installer by creating a hidden delete-on-close temp file sized to remaining free space, with worker threads reclaiming capacity if files change; it may also open MRT.exe with restrictive sharing to interfere with staging.

No CVE assigned in the BleepingComputer write-up; Microsoft initially had not commented. PoC: github.com/MSNightmare/BigDiskBuster.

Correction (24 Oct 2026): BleepingComputer's article, updated 26 September, carries a Microsoft statement that Microsoft Defender Antivirus detects BigDiskBuster and includes detection and prevention for observed activity; Microsoft did not say a CVE had been assigned and told customers to keep Defender security intelligence and platform updates current. (source: BleepingComputer)

Correction (25 Oct 2026; revised 27 Oct 2026): the card date is 22 September 2026, the date BleepingComputer's report visibly shows (it describes the disclosure as happening over the weekend). A repository-creation time taken from GitHub API metadata has been removed because that page could not be read. A Cyber Security News link dated 21 September has been removed because we can no longer read that site, so its date could not be checked. (source: BleepingComputer)