Title: Some interesting findings in Windows Defender
Date: 2026-07-09
Source: pnc
Origin: https://blog.projectnightcrawler.dev/posts/2026-07-09-some-interesting-findings-in-windows-defender/
Author: NightmareEclipse
Mirror: live
Upstream live: yes

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

As many of you may have seen, Microsoft issued a security patch for RoguePlanet

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-50656

There is a problem in mpengine.dll, the newly introduced mitigations or as Microsoft calls them "defense-in-depth updates" can cause windows defender to leak 8 bytes of data while attempting to open a file in certain scenarios, I'm still trying to find a way to obtain the leaked bytes as a standard user but for now it only leaks data to drivers.

Now one thing I noticed with Windows Defender is the fact that it is very careful when handling file sizes, there is hard limits on how big the file can be when scanning and quarantining files. 
This implementation make sense, because quarantining a huge file will cause Defender to completely exhaust the available disk space.
I found a small exception to this rule, apparently the spynet functions in mpengine.dll really wants to keep a local copy of :Zone.Identifier ADS file and it does not matter how big this file is, Windows Defender will cache it locally anyways.

You will need a special setup to exploit this, a custom SMB server that will be handling requests from Windows Defender is needed, the SMB server should serve a malicious file (a good example is mimikatz executable) followed by a massive ADS file (a good example is mimikatz.exe:Zone.Identifier), in the process of replying to the read requests, at some point the SMB server should never respond to the read request but keep the connection alive. This will cause Defender to hang and keep a lock on the offending files that holds the entire disk space.
Obviously this won't crash the machine but windows won't behave properly with a full disk, multiple apps and services crash randomly.

I managed to reproduce this issue in Windows 11 25H2 and Windows Server 2025, visiting an SMB server will cause Defender to completely exhaust your disk space. I'm trying to get it to work with webdav so we can skip the authentication requirement, I'm not sure if it's possible because attempting to open an ADS in a webdav causes the request to fail with STATUS_INVALID_PARAMETERS, I'm not sure if it's a problem with my custom webdav implementation because it shows the ADS open attempt as a weird "file.exe/%3AZone.Identifier" so maybe I'm doing smtg wrong but it might work.

I was thinking about a way to exploit this remotely without needing a victim to open your special SMB server but nothing crossed my mind. If there was a way to convince Defender to scan files remotely then this issue is exploitable and would be very powerful against servers.

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRJTvAf/AWVhAKEeb7FFoRCS0/SbAUCak9PxAAKCRDFFoRCS0/S
bMhlAP9E/+DDlgTETq6hv+8C8uSM/uPw5Y58E+M5N75YuMy3bQEAxM7skjH0Z8Qe
akF46r2jnIIclzU13oeryvr01S32CwE=
=V3bX
-----END PGP SIGNATURE-----
