Microsoft patched a nasty zero-day in Windows Defender on Wednesday. The fix itself might have introduced a new problem: it could let attackers fill your hard drive to capacity.
The vulnerability, tracked as CVE-2026-50656 and nicknamed RoguePlanet, was disclosed in June by a researcher going by NightmareEclipse. It allows remote attackers to gain admin control of Windows 10 and Windows 11 machines — even with real-time protection turned off. The fix was shipped via an automatic update to the Microsoft Malware Protection Engine.
But the researcher says the patch introduces a new issue. The defense-in-depth additions in mpengine.dll can cause Defender to leak 8 bytes of data when opening a file. Combined with SpyNet functionality, this can trigger Defender to write files of unlimited size to disk.
The exploit requires a custom SMB server that serves a malicious file with a massive Zone.Identifier alternative data stream attached. If the SMB server keeps the connection alive without completing the read, Defender hangs and holds a lock on the file — consuming disk space indefinitely.
“This won’t crash the machine but windows won’t behave properly with a full disk,” the researcher wrote. Multiple apps and services crash randomly.
Microsoft hasn’t confirmed whether the described behavior exists.
This is the latest chapter in an ongoing feud between NightmareEclipse and Microsoft. The researcher has released exploit code for several zero-days since May, sometimes before Microsoft could patch them. Microsoft publicly criticized the disclosures and hinted at legal action, then backed off after public backlash. This doesn’t appear to be resolved.
