On July 12, 2026, Microsoft released a security update intended to fix a critical zero‑day flaw in Windows Defender, but researchers say the patch may have introduced a fresh attack vector that could let threat actors fill a system’s drive with quarantined files. The discovery follows a bitter exchange between the independent researcher known as NightmareEclipse and Microsoft’s security team.
The original vulnerability allowed malicious code to bypass Defender’s real‑time protection and execute with system privileges. Microsoft’s rapid response deployed a driver‑level fix that altered how the anti‑malware service handles quarantine operations. Analysts now argue that the change unintentionally creates a loop where crafted files are repeatedly marked for quarantine, consuming disk space until the device becomes unusable. The issue was first reported by security researcher Alfonso Maruccia, who warned that the bug could be weaponized in a denial‑of‑service style attack.
The new code modifies the quarantine flag without properly checking available storage. When an attacker supplies a specially crafted payload, Defender repeatedly copies the file into its quarantine folder, each copy occupying additional megabytes. Over time, the cumulative effect can exhaust the entire volume, causing applications to crash and the operating system to stall. Microsoft’s internal testing reportedly missed this edge case, focusing instead on preventing remote code execution. Security experts stress that the flaw is exploitable on any Windows 10 or 11 machine that has the latest Defender definitions installed.
Early tests by independent labs confirm that the storage‑filling behavior can be triggered with minimal effort. By sending a sequence of benign‑looking files to a vulnerable system, an attacker can force Defender to quarantine each item, rapidly depleting free space. The researchers observed that a single gigabyte of free storage could vanish within minutes on a typical workstation. While the attack does not grant direct control over the system, the resulting denial of service can be leveraged to distract administrators while other exploits are deployed.
The broader impact of this oversight may force Microsoft to issue an urgent hotfix and reevaluate its patch validation processes. Enterprises that rely heavily on Defender for endpoint protection could face operational disruptions if the bug is exploited in the wild. Analysts predict that Microsoft will prioritize a corrective update and may offer guidance on temporary mitigation, such as disabling automatic quarantine for untrusted files until a proper fix is released.
What is the original zero‑day that prompted the patch? The initial flaw allowed malicious code to bypass Windows Defender’s real‑time scanning, granting attackers system‑level privileges to run arbitrary programs.
How does the new bug differ from the original vulnerability? Instead of enabling code execution, the new issue causes Defender to repeatedly quarantine files, consuming disk space until the storage is exhausted, leading to a denial‑of‑service condition.
What steps can users take to protect themselves now? Users should monitor their disk usage closely, apply any forthcoming updates from Microsoft promptly, and consider temporarily disabling automatic quarantine for suspicious files if feasible.