Microsoft Patch for Windows Defender May Cause Disk Space Issues
A security update released by Microsoft in July for Windows Defender could, according to researchers, lead to disk space being filled and applications crashing under certain conditions.
Microsoft released a security update on July 7, addressing a vulnerability known as RoguePlanet (CVE-2026-50656) in Windows 10 and Windows 11 operating systems. The vulnerability was rated with a CVSS 3.1 score of 7.8, allowing a remote attacker to gain administrator privileges.
The exploit leveraged a race condition within Microsoft Defender's scanning engine. A successful attack would grant the attacker the ability to install software, read or delete files, create new user accounts, disable security features, and move laterally within a network.
However, security researcher NightmareEclipse observed shortly after the patch's release that the new fix might introduce new risks. The report indicates that the Microsoft Malware Protection Engine component could, in specific scenarios, leak data. Additionally, it may cache large Alternate Data Streams (ADS) locally without updating or deleting them.
If an attacker combines this with a malicious SMB server and uses large ADS files along with tools like Mimikatz, Defender could freeze while processing files. This could result in Defender locking files and consuming all available disk space, even if the system itself does not crash with a blue screen. Users, however, may experience system slowdowns and random application crashes.