Microsoft released a patch on Wednesday addressing a zero-day vulnerability in its Defender security engine known as RoguePlanet, tracked as CVE-2026-50656. The flaw was originally disclosed in June by NightmareEclipse, a pseudonymous researcher, along with functional exploit code. The vulnerability permits remote attackers to obtain administrative access on Windows 10 and Windows 11 systems, even when real-time protection has been disabled.
According to NightmareEclipse, the defense-in-depth mitigations included in Wednesday’s update to the Microsoft Malware Protection Engine may introduce unintended consequences. The researcher stated that the new protections could allow attackers to exhaust available hard drive space by writing large amounts of data. The issue stems from behavior in mpengine.dll, the driver for the Malware Protection Engine, which in certain cases leaks 8 bytes of data when opening files. Additionally, functionality in SpyNet, Microsoft’s cloud service for reporting suspicious software, contributes to the potential disk-filling behavior.
The specific exploit targets a mechanism within mpengine.dll related to Zone. Identifier alternative data streams. These are hidden metadata files that Windows associates with externally sourced files to track their origin and security classification. Windows Defender normally enforces file size limits during scanning and quarantining operations, but NightmareEclipse identified an exception where SpyNet functions attempt to cache Zone. Identifier files without size restrictions. An attacker could trigger this vulnerability using a specially configured SMB server that serves a malicious file followed by an extremely large ADS file, causing Defender to hang while holding locks on files that consume the entire disk.
The disclosure reflects ongoing tensions between NightmareEclipse and Microsoft that began in May. The researcher has released details and exploit code for multiple vulnerabilities prior to Microsoft’s patch availability, citing the company’s alleged silent patching of a privately reported flaw. Microsoft has criticized the approach as irresponsible disclosure and previously suggested potential legal action, though later retreated from that position following public criticism. Microsoft stated it is aware of the current report and is investigating the matter.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI