The BigDiskBuster exploit is similar to another Defender zero-day called UnDefend, which Naceri released in April 2026 and that also allowed standard users to block definition updates. In a social media post, Naceri described the tool as a 'funny tool' that denies Defender from updating, though he noted the proof-of-concept is 'a bit buggy and needs some rewriting.'
Since April, Naceri has disclosed nearly a dozen Windows zero-day vulnerabilities as part of an ongoing dispute with Microsoft over what he claims was his unfair termination from the company in March 2025. Two weeks ago, he released a separate Defender zero-day exploit called ShieldCrash that grants SYSTEM access, shortly after Microsoft patched a related flaw known as ShieldBreak. Earlier in the year, he published the RoguePlanet exploit, which Microsoft fixed in July.
The researcher has published the BigDiskBuster code on GitHub, making it publicly available. Microsoft has not yet responded to the latest disclosure, and it remains to be seen when the company will issue a patch. The exploit does not directly compromise systems but prevents Defender from receiving updates, potentially exposing users to new and unaddressed threats.