Windows Defender patch resolves zero-day vulnerability but risks disk space exhaustion

On Wednesday, Microsoft released a patch for a zero-day vulnerability in its Windows Defender security engine, known as RoguePlanet (CVE-2026-50656). Discovered by the researcher NightmareEclipse, this flaw could allow remote attackers to gain administrative control over Windows 10 and Windows 11 machines, even with real-time protection disabled.

Impact of RoguePlanet Vulnerability

RoguePlanet came to light in June, when NightmareEclipse disclosed the vulnerability alongside exploit code. Microsoft’s patch aims to address the issue; however, it inadvertently introduces a new risk. According to NightmareEclipse, the update may enable attackers to fill a hard drive by writing excessively large files, potentially causing system instability.

The patch, which updates the Microsoft Malware Protection Engine, is automatically downloaded and installed without user intervention. Along with fixing the zero-day vulnerability, it includes additional defense-in-depth updates aimed at enhancing overall security. However, these updates have created a problem in the mpengine.dll driver, which may leak data while opening files.

Technical Details of the Exploit

The vulnerability allows a malicious actor to exploit the behavior of the Server Message Block (SMB) protocol, which is used for sharing files over a local network. NightmareEclipse explains that a custom SMB server can be set up to serve a malicious file followed by a massive ADS file (alternative data stream). This setup can cause Windows Defender to hang, locking files that consume the entire disk space.

NightmareEclipse stated, “This implementation makes sense, because quarantining a huge file will cause Defender to completely exhaust the available disk space.” The researcher highlights that while this issue does not crash the machine, it can lead to erratic behavior, crashing multiple apps and services.

Microsoft's Response and Ongoing Dispute

Microsoft has not confirmed whether the described behavior exists. The relationship between NightmareEclipse and Microsoft has been contentious, with the researcher previously accusing the company of not responsibly disclosing vulnerabilities. Following public backlash, Microsoft retracted threats of legal action against the researcher.

The ongoing feud suggests the issue is far from resolved, with both parties continuing to engage in public disputes over vulnerability disclosures. As cybersecurity threats evolve, the implications of this vulnerability and the effectiveness of the patch will be closely monitored by security experts.