Microsoft's Defender Patch for RoguePlanet Zero-Day Introduced a New Disk-Exhaustion Vulnerability

The Patch That Created a New Problem

Microsoft pushed an update Wednesday to the Microsoft Malware Protection Engine, the core component behind Windows Defender, to address CVE-2026-50656, a critical zero-day known as RoguePlanet. The flaw allows remote attackers to gain administrative control of Windows 10 and Windows 11 machines, even with real-time protection turned off.

The fix was automatic. Microsoft said users needed to take no action, and the update would silently download and install itself. That part worked as designed.

What did not work: the "defense-in-depth" additions bundled into the same update.

According to Ars Technica, the researcher who discovered RoguePlanet, operating under the pseudonym NightmareEclipse, posted Thursday that the new mitigations introduced a bug in `mpengine.dll`, the driver tied to the Malware Protection Engine, that leaks 8 bytes of data when the engine attempts to open a file.

How the Disk-Fill Attack Works

Normally, Defender enforces hard limits on how much data it will write to disk when scanning and quarantining files, specifically to prevent disk exhaustion. That safeguard exists for good reason: a quarantined file large enough to fill a drive would crash the machine.

The new mitigations created a gap in that safeguard. According to NightmareEclipse's post, SpyNet, Microsoft's cloud reporting service used by Security Essentials and Forefront Endpoint Protection, will cache a local copy of a Zone.Identifier alternative data stream regardless of how large that file is. Defender's size limits don't apply there.

A Zone.Identifier is a hidden metadata file Windows automatically attaches to anything downloaded from the internet or received from external sources. It records origin and security zone information.

The attack vector: a malicious actor sets up a custom SMB server (Server Message Block, the Windows file-sharing protocol) configured to serve files with Zone.Identifier streams of arbitrary size. When Defender scans those files, it caches the streams locally without size restriction, potentially writing data until the disk is full. According to Ars Technica, NightmareEclipse explained the exploit requires a specially configured SMB server to execute.

Who Is NightmareEclipse?

According to Windows Central, NightmareEclipse (also referenced in some reports as Chaotic Eclipse) has published a series of zero-days over recent months: YellowKey, GreenPlasma, MiniPlasma, and now RoguePlanet. The researcher also previously claimed to have bypassed Windows 11's BitLocker encryption using a USB stick, alleging Microsoft "intentionally" left a backdoor. Microsoft has not publicly confirmed or denied that specific allegation.

A separate April 2026 investigation by security firm Cyderes documented BlueHammer, another publicly released Windows zero-day attributed to the same researcher's alias Chaotic Eclipse. That exploit abuses the interaction between Defender's update workflow, Volume Shadow Copy, the Windows Cloud Files API, and opportunistic locks to escalate a low-privileged local user to NT AUTHORITY\SYSTEM, the highest privilege level on a Windows machine. Cyderes confirmed BlueHammer allowed an attacker to read the SAM database, decrypt NTLM password hashes, take over a local administrator account, and spawn a SYSTEM-level shell, while restoring the original password hash to avoid detection.

Cyderes noted that Defender signature updates now flag the original BlueHammer proof-of-concept binary. But because the weakness sits in how Windows components interact rather than in a single exploitable file, an attacker can modify the implementation and bypass that detection.

The Coordination Problem

The strongest legitimate concern raised by security professionals is about disclosure method. NightmareEclipse and Chaotic Eclipse have consistently dropped working exploit code publicly, without advance notice to Microsoft and without assigning CVEs through standard channels. Cyderes noted that when BlueHammer went public in April 2026, there was no coordinated disclosure, no CVE, and no patch. Microsoft's only response at the time was a statement that it "supports coordinated vulnerability disclosure." Cyderes flagged that phrasing as pointed given the circumstances.

Full public disclosure of working exploit code before a patch exists hands criminals and nation-state actors a ready weapon. Responsible disclosure exists for a reason.

At the same time, the researcher's track record suggests Microsoft was on notice for months that this research was ongoing, and the speed at which working exploits keep appearing in Defender raises questions about how thoroughly that product is being audited internally. According to Windows Central, NightmareEclipse told Microsoft: "I was not bluffing Microsoft, and I'm doing it again."

What Microsoft Actually Claimed About Defender

Microsoft has publicly positioned Defender as sufficient for most users. According to Windows Central, Microsoft stated: "Microsoft Defender Antivirus covers everyday risks without requiring additional software." Each new zero-day in the same product tests that claim.

Microsoft has not publicly responded to Thursday's report about the disk-exhaustion bug introduced by the Wednesday patch, as of July 9, 2026. No second patch has been announced.

The unresolved question: whether the disk-exhaustion behavior NightmareEclipse identified in the updated `mpengine.dll` will be addressed with another silent Defender engine update, or whether Microsoft will require users to take manual action. Given the automatic-update architecture of Malware Protection Engine patches, that would mark a significant departure from how Microsoft has handled every previous fix in this series.