{"rewrite":{"id":"r_615eb0ede1e4007da4e104e9","clusterId":"c_d0dbfde9fd328c13011f23ce","slug":"microsoft-defender-update-after-fix-opens-new-disk-filling-attack","model":"deepseek-v4-flash","headline":"Microsoft Defender Update After Fix Opens New Disk-Filling Attack","summary":"Security researcher Nightmare Eclipse reports that Microsoft's fix for the RoguePlanet vulnerability introduced a new issue in Defender. The antivirus no longer applies caching limits to certain alternate data streams, allowing an attacker to fill a Windows 11 drive via a malicious SMB server. The attack was reproducible on Windows 11 25H2 and Windows Server 2025. Microsoft has not commented.","whyItMatters":"The new vulnerability suggests the patch for the RoguePlanet flaw may have inadvertently created a different vector for resource exhaustion, with potential for remote exploitation if WebDAV compatibility is confirmed.","webCardHtml":"\u003cp\u003eThe limits Microsoft Defender normally applies to file scanning and quarantine do not apply to cached alternate data streams labeled Zone.Identifier, the researcher said. That makes it possible to force Defender to write a large cache to disk. In a proof of concept, placing a file and a specially crafted large Zone.Identifier ADS on a malicious SMB server, then intentionally stopping a read operation while keeping the SMB session open, caused Defender to keep the cache locked and not delete it, eventually filling the drive. The attack was reproducible on Windows 11 25H2 and Windows Server 2025. Nightmare Eclipse is also investigating whether the same method can be used over WebDAV, which would allow internet-based exploitation without SMB. Microsoft has not yet commented on the reported disk exhaustion issue as of the article\u0026#39;s publication.\u003c/p\u003e","blueskyPost":"After patching the RoguePlanet vulnerability, Microsoft Defender's update created a new attack vector that can fill a Windows 11 PC's disk space using cached Zone.Identifier ADS. The researcher demonstrated the attack via SMB and is testing WebDAV. Microsoft hasn't commented.","twitterPost":"After patching the RoguePlanet vulnerability, Microsoft Defender's update created a new attack that can fill a Windows 11 PC's disk space using cached Zone.Identifier ADS. Demonstrated via SMB, with WebDAV possible. Microsoft hasn't commented.","threadsPost":null,"newsletterBlurb":"A security researcher found that after Microsoft fixed the RoguePlanet vulnerability in Defender, a new issue arose where the antivirus can be forced to fill a Windows 11 drive. The attack exploits gaps in caching limits for alternate data streams. Microsoft has not yet responded.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20260715-microsoft-defender-fill-storage/\",\"title\":\"New Microsoft Defender update could let hackers completely fill Windows 11 PC disk space\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4190,"outputTokens":2818,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1784138608,"createdAt":"2026-07-15T17:53:15.000Z","publishedAt":"2026-07-15T17:57:29.000Z","updatedAt":"2026-07-15T17:53:15.000Z"},"cluster":{"id":"c_d0dbfde9fd328c13011f23ce","canonicalTitle":"Microsoft Defenderの新しいアップデートによりハッカーがWindows 11 PCのディスク容量を完全に使い果たしてしまう可能性がある","representativeArticleId":"a_567083f115915b473b15bcbd","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-07-15T03:29:00.000Z","lastSeenAt":"2026-07-15T03:29:00.000Z","updatedAt":"2026-07-15T17:57:29.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20260715-microsoft-defender-fill-storage/","title":"Microsoft Defenderの新しいアップデートによりハッカーがWindows 11 PCのディスク容量を完全に使い果たしてしまう可能性がある"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":null}