BleepingComputer (Sergiu Gatlan; coverage of weekend disclosure) reports security researcher Abdelhamid Naceri (MSNightmare / Nightmare Eclipse) released BigDiskBuster, a local proof-of-concept that prevents Microsoft Defender Antivirus from completing platform and security-intelligence updates while it runs. The tool watches Defender Platform/Definition Updates directories on the C: volume and starves the installer by creating a hidden delete-on-close temp file sized to remaining free space, with worker threads reclaiming capacity if files change; it may also open MRT.exe with restrictive sharing to interfere with staging.

Distinct from desk cards ms-defender-shieldcrash-20260909 / CVE-2026-69414 (ShieldCrash SYSTEM file-read after ShieldBreak).

No CVE assigned in the BleepingComputer write-up; Microsoft initially had not commented. PoC: github.com/MSNightmare/BigDiskBuster.

Correction (24 Oct 2026): BleepingComputer's article, updated 26 September, carries a Microsoft statement that Microsoft Defender Antivirus detects BigDiskBuster and includes detection and prevention for observed activity; Microsoft did not say a CVE had been assigned and told customers to keep Defender security intelligence and platform updates current. (source: BleepingComputer)

Correction (25 Oct 2026): the card date has moved from 21 to 20 September 2026 (Perth time), the date the BigDiskBuster proof-of-concept repository (github.com/MSNightmare/BigDiskBuster) was created on GitHub: 20 September, 07:31 Perth time (AWST), which was 19 September, 23:31 UTC, per the repository creation timestamp in the GitHub API.

BleepingComputer's report is dated 22 September (05:55 US Eastern, 17:55 Perth). A Cyber Security News link dated 21 September has been removed because we can no longer read that site, so its date could not be checked. (source: GitHub)