Microsoft's Defender patch inadvertently creates disk-filling vulnerability

Microsoft's latest patch for a critical zero-day vulnerability in Windows Defender contains a new flaw that could allow attackers to write massive files to a machine until its disk runs out of space, according to the researcher who originally disclosed the original security hole.

The underlying vulnerability#

NightmareEclipse, the pseudonymous researcher behind recent Windows zero-day discoveries, first revealed the RoguePlanet flaw (CVE-2026-50656) in June, along with working exploit code. The initial vulnerability granted remote attackers administrative-level access to Windows 10 and 11 systems, even if real-time antivirus protection was switched off. This researcher has become something of a thorn in Microsoft's side, publishing multiple critical flaws in recent months.

How the patch backfired#

Microsoft addressed the original issue Wednesday with an update to the Microsoft Malware Protection Engine (mpengine.dll), the core component of Windows Defender. The company also bundled in "defense-in-depth" security enhancements intended to strengthen other protections.

However, the researcher's Thursday analysis revealed that these new mitigations introduced an unintended consequence. The additions cause mpengine.dll to leak memory in certain file-opening operations and interact problematically with SpyNet, Microsoft's cloud-based threat reporting service. Together, these behaviors bypass Defender's normal safeguards that prevent the tool from writing oversized files.

The disk-exhaustion problem#

Defender ordinarily enforces file-size limits during scanning and quarantine operations to prevent the antivirus engine itself from filling up a drive. Yet the new code contains an exception: when SpyNet attempts to cache a Zone.Identifier alternate data stream file, it disregards these limits entirely. As the researcher explained: "the spynet functions in mpengine.dll really wants to keep a local copy of Zone.Identifier ADS file and it does not matter how big this file is, Windows Defender will cache it locally anyways."