Microsoft's Defender Fix Backfires: New Patch May Let Hackers Brick Your Storage

What was supposed to be a security win for Microsoft has turned into another headache. A patch released Wednesday to address a serious zero-day vulnerability in the Windows Defender security engine appears to have introduced its own potentially dangerous behavior — one that could allow attackers to completely exhaust available disk space on a targeted Windows machine. The researcher who originally uncovered the flaw, operating under the pseudonym NightmareEclipse, was quick to flag the newly introduced problem just a day after the fix went live.

The original vulnerability, tracked as CVE-2026-50656 and dubbed RoguePlanet, first came to public attention in June when NightmareEclipse disclosed both details of the flaw and working exploit code. The vulnerability is serious: it allows remote attackers to gain administrative control over Windows 10 and Windows 11 systems, even when real-time protection is turned off. Microsoft patched it through an update to the Microsoft Malware Protection Engine — the core component underpinning Windows Defender — which automatically downloads and installs without requiring user action.

The trouble lies in the so-called 'defense-in-depth' additions bundled alongside the fix. According to NightmareEclipse, new code within mpengine.dll — the driver tied to Microsoft's Malware Protection Engine — can in certain circumstances cause an 8-byte data leak each time it attempts to open a file. Compounding matters, updated functionality within SpyNet, Microsoft's cloud reporting service for suspicious software activity, interacts with this behavior in a way that could trigger massive, uncapped file writes to local storage.

Normally, Windows Defender enforces strict size limits on files written during scanning and quarantine processes to prevent precisely this kind of storage exhaustion. However, NightmareEclipse identified an exception: the SpyNet-related functions inside mpengine.dll will cache a local copy of a Zone.Identifier alternative data stream regardless of the file's size. A Zone.Identifier is a hidden metadata file Windows automatically attaches to files downloaded from the internet or external sources. An attacker could exploit this using a specially crafted SMB server — a standard Windows file-sharing protocol — by serving a malicious file alongside an enormous associated Zone.Identifier stream, then stalling the connection to keep Defender locked and the disk perpetually occupied.

Microsoft did not immediately respond to requests for comment confirming whether this behavior exists in the patched build. The episode is just the latest chapter in a prolonged and increasingly hostile dispute between the company and NightmareEclipse, which began in May after the researcher alleged Microsoft had silently patched a vulnerability they had privately reported without proper credit. That grievance triggered a wave of public zero-day disclosures before patches were ready, prompting Microsoft to publicly criticize NightmareEclipse for irresponsible disclosure and hint at possible legal action — a threat it later walked back following significant public backlash.