Your Windows 11 machine grinds to a halt. Updates fail. Apps crash mid-save. The culprit isn’t ransomware or a rogue browser extension — it’s your antivirus doing its job a little too enthusiastically. Microsoft recently shipped engine version 1.1.26060.3008 to kill RoguePlanet (CVE-2026-50656), a zero-day that let any low-privileged attacker escalate straight to SYSTEM access. Public exploit code exists. Active exploitation has been confirmed. The patch was necessary and urgent. But according to security researcher Nightmare-Eclipse, the fix introduced a new problem: under specific conditions, attackers can weaponize the updated engine to fill your entire disk to capacity.
The Zero-Day Microsoft Had to Kill
Patching RoguePlanet was non-negotiable — but the cure came with an unexpected side effect.
Engine version 1.1.26050.11 contained an improper link resolution bug — the kind of flaw (CWE-59) that turns a basic user account into full SYSTEM control. Think of it as hiring a bouncer who hands out VIP wristbands to everyone in line. Microsoft’s fix ships automatically through Defender’s security intelligence updates. If your engine version is older, force it through Windows Update immediately. No ambiguity here.
But while that door closed, another cracked open. Nightmare-Eclipse found the patched engine mishandles cached Zone.Identifier alternate data streams — small metadata tags Windows attaches to files downloaded from the network. Defender normally enforces size limits on scanned and quarantined content. Those guardrails reportedly don’t apply to these cached ADS entries. A malicious SMB server can deliver a file with an oversized ADS, deliberately stall the read operation, and watch Defender’s cache grow without a ceiling — per reporting by news.cx. The security engine, in effect, becomes the attack surface.
What “Disk Full” Actually Means for You
A maxed-out system drive doesn’t just slow things down — it breaks everything at once.
Windows Update refuses to install patches. Applications crash mid-task. Boot problems follow. It’s the same disruption malware delivers, except your own security engine is causing it. The researcher’s proof-of-concept has been verified on Windows 11 25H2 and Windows Server 2025.
If you’re a home user, breathe. This attack requires network access and specific SMB delivery conditions — significantly harder to pull off than the original privilege escalation. Enterprise admins running exposed file shares face more immediate risk. Nightmare-Eclipse is actively investigating whether WebDAV delivery could remove the SMB requirement entirely, which would make this exploitable over the public internet — a meaningful escalation in threat scope.
Microsoft has not yet publicly commented on the disk exhaustion behavior; the official advisory covers only the RoguePlanet privilege escalation fix.
Check your engine version now:
- Open Windows Security
- Go to Virus & threat protection
- Go to Protection updates
- Confirm you’re running 1.1.26060.3008 or higher
If not, update immediately. Then monitor disk space on critical volumes and watch for a follow-up engine revision that addresses the ADS caching behavior. Staying unpatched remains the worse option — like refusing to fix the lock on your front door because the locksmith scuffed the paint.
