Patch for Windows Defender 0-day could allow attackers to fill hard disk
| Source: Ars Technica AI
Tags: CVE-2026-50656, Windows Defender, Microsoft, NightmareEclipse, cybersecurity, zero-day, RoguePlanet
Microsoft's patch for CVE-2026-50656 (RoguePlanet), a Windows Defender zero-day enabling remote admin takeover of Windows 10/11 even with real-time protection disabled, itself introduces a new risk: the defense-in-depth update may let attackers exhaust disk space by bypassing Defender's file-size caps via SMB and the SpyNet reporting mechanism.
Details
Microsoft auto-deployed an update to its Malware Protection Engine on Wednesday to patch CVE-2026-50656, nicknamed RoguePlanet — a zero-day disclosed by the pseudonymous researcher NightmareEclipse that enables remote attackers to gain administrative control of Windows 10 and Windows 11 machines, even when real-time protection is disabled. The fix installs automatically without user action. The following day, NightmareEclipse posted that the patch itself introduces a new problem. The defense-in-depth additions cause mpengine.dll — the core Defender engine driver — to leak 8 bytes of data when opening certain files. More critically, new SpyNet cloud reporting functionality bypasses Defender's normal caps on file write size. Specifically, Defender caches Zone.Identifier alternative data streams (hidden metadata tracking a file's internet origin) with no size limit, unlike regular quarantined files. A malicious actor can exploit this via SMB protocol to trigger unlimited writes to disk, potentially filling all available storage on an endpoint. The source article is truncated and full exploit details are not available. This is the latest in a pattern of Windows Defender zero-days from NightmareEclipse that have forced Microsoft into rapid patch cycles over recent months.