A recently released patch by Microsoft aims to address a pressing zero-day vulnerability in its Defender security engine. However, this update may inadvertently lead to issues where Windows machines could consume all available disk space through excessive file writing, caution the researchers behind the discovery.
The vulnerability, referred to as RoguePlanet and tracked under the identifier CVE-2026-50656, was initially disclosed in June by the researcher known as NightmareEclipse. This individual, who operates under a pseudonym, provided not only the details of the flaw but also the exploit code that could be used by malicious actors. This security hole enables remote attackers to gain administrative control over Windows 10 and Windows 11 systems, even when real-time protection is disabled. Over the past few months, NightmareEclipse has publicly unveiled several zero-day exploits, prompting Microsoft to quickly develop patches to counteract them.
Writing Files of Unlimited Size
On Wednesday, Microsoft announced that it had patched the RoguePlanet vulnerability via an update to the Microsoft Malware Protection Engine, which underpins the Defender antivirus application. Importantly, this fix is designed to be automatically downloaded and installed by users without any required action on their part. Alongside this critical patch, the update also introduces “defense-in-depth” enhancements intended to bolster security features.
However, in a post following the patch’s release, NightmareEclipse warned that these newly implemented defense strategies could lead to detrimental behavior. Specifically, they may allow attackers to fill up hard drives completely by writing enormous volumes of data. The issue stems from mpengine.dll— the driver associated with the Microsoft Malware Protection Engine— which may leak 8 bytes of data when trying to open a file. Furthermore, a new mechanism within SpyNet, a cloud-based service, is implicated in this potential misbehavior. SpyNet enables Microsoft Security Essentials or Forefront Endpoint Protection to send reports regarding suspicious software back to Microsoft.
In standard operation, Windows Defender enforces limits on file sizes when it scans and quarantines files, preventing any single file from consuming all available disk space. NightmareEclipse noted, “This implementation makes sense because quarantining a huge file will cause Defender to completely exhaust the available disk space.” He pointed out a peculiar exception related to the spynet functions in mpengine.dll, which endeavors to maintain a local copy of the Zone.Identifier Alternate Data Stream (ADS) file, regardless of its size. This behavior poses a risk as it can potentially fill hard drives without regard for available capacity.
In summary, while the intent behind Microsoft’s patch for the RoguePlanet vulnerability is to enhance security, the update introduces a new challenge that could lead to significant operational issues for users. As we navigate these updates, it is crucial for both individuals and organizations to stay informed about the implications of security patches.
For more details, you can visit the original article Here.
Image Credit: arstechnica.com
