Researcher alleges Microsoft Defender patch creates denial-of-service risk via disk exhaustion

Microsoft released an update on July 9, 2026 to address CVE-2026-50656, a zero-day in the Microsoft Malware Protection Engine used by Windows Defender. The patch was delivered automatically to affected systems.

The anonymous researcher NightmareEclipse, who publicly disclosed the vulnerability in June, now alleges the patch introduces a new behavior: Defender may write unbounded amounts of data to disk while processing Zone.Identifier alternative data streams, potentially exhausting available storage.

NightmareEclipse describes a scenario where a malicious actor operates a custom SMB server that serves a file (e.g., mimikatz.exe) followed by a large Zone.Identifier stream. By keeping the SMB connection alive without completing the read request, Defender holds locks on the files, causing disk space to be consumed until the drive is full.

The researcher notes that Windows Defender normally enforces hard limits on file sizes during scanning and quarantine to prevent disk exhaustion, but claims the SpyNet-related functionality in mpengine.dll bypasses these limits for Zone.Identifier streams.

Microsoft has not publicly confirmed the behavior described by NightmareEclipse. The company did not immediately respond to questions about the issue.

The dispute between NightmareEclipse and Microsoft dates back at least to May 2026, when the researcher accused Microsoft of silently patching a privately reported vulnerability without credit or coordinated disclosure. Subsequent releases of exploit code and additional zero-days by NightmareEclipse prompted Microsoft to publicly criticize the disclosure approach and hint at possible legal action before walking back the threat amid public backlash.