Windows Defender Disk Space Vulnerability: What the July 2026 Patch Fixes

The Windows Defender disk space vulnerability patched in July 2026 is one of the most disruptive security flaws to hit Windows in recent memory — and it affects virtually every Windows 10 and Windows 11 machine running Microsoft’s built-in antivirus. Tracked as CVE-2026-33825, the bug allowed remote attackers to abuse Defender’s own scanning engine to flood a target’s hard drive with junk data until the disk was completely full, effectively making the system unusable. Here is exactly what you need to know, what the patch fixes, and how to confirm your PC is protected.

What Is the Windows Defender Disk Space Vulnerability?

CVE-2026-33825 is a privilege escalation and denial-of-service flaw rooted in insufficient granularity of access control within the Microsoft Malware Protection Engine — the core scanning component that powers Windows Defender. Researchers at multiple threat intelligence firms, including those who follow the threat actor cluster dubbed BlueHammer, confirmed that the flaw was being actively exploited in the wild before Microsoft’s patch landed.

The attack chain works like this: a remote attacker tricks Defender’s real-time protection engine into logging an extremely large volume of diagnostic or quarantine data. Because the engine runs with elevated system privileges, it can write this data without the normal disk-space guardrails that apply to regular user processes. Left unchecked, the process fills every available byte on the system drive — bringing the PC to a standstill. No disk space means Windows cannot write page files, update system logs, or even save documents, effectively locking the user out.

• Vulnerability ID: CVE-2026-33825
• Component affected: Microsoft Malware Protection Engine
• Attack type: Remote-triggered privilege escalation + disk exhaustion
• Platforms at risk: Windows 10 (all supported builds) and Windows 11
• Severity: Critical — CVSS score published on the NVD reflects elevated risk due to active exploitation
• Patch released: July 2026 (out-of-band security update)

Why the Defender Disk Flaw Is Particularly Dangerous

Most security vulnerabilities require an attacker to already have local access to the machine, but this Defender disk vulnerability could be triggered remotely — making it far more threatening for home users and businesses alike. The fact that the exploit weaponises a security tool itself against the system it is meant to protect is a recurring and particularly nasty attack pattern.

What made this Defender disk space bug especially problematic is that Defender’s real-time protection is on by default on every Windows installation that doesn’t have a third-party antivirus active. That means the attack surface was enormous. According to StatCounter, Windows holds roughly 72% of global desktop OS market share as of mid-2026, and the vast majority of those machines run Defender as their primary security layer. Even users who believed they were safe because they kept Windows updated were exposed until Microsoft pushed the fix.

There is also the stealth factor. A disk-fill attack triggered via Defender generates no obvious malware alert — because Defender itself is doing the writing. By the time a user notices the system grinding to a halt, the drive may already be at 100% capacity.

Who Was at Risk from the Windows Defender Flaw?

Any device running a version of the Microsoft Malware Protection Engine prior to 1.1.26060.x (the patched engine version released in July 2026) was potentially at risk. In practical terms, that meant:

• All Windows 10 users on supported builds (22H2 and later) with Defender enabled
• All Windows 11 users — including those on 23H2 and 24H2 — who had not yet received the out-of-band engine update
• Enterprise environments using Microsoft Endpoint Protection or Microsoft Security Essentials, which share the same engine
• Systems where Defender was in passive mode alongside a third-party AV, since the Protection Engine still receives definition updates and remained partially active

Users running fully third-party antivirus solutions with Defender completely disabled were largely shielded, but this represented a small fraction of the Windows user base.

What the Patch Actually Fixes

Microsoft’s July 2026 out-of-band update addresses the Windows Defender disk space vulnerability by implementing stricter access controls around how the Malware Protection Engine writes diagnostic, quarantine, and log data. Specifically, the patch:

1. Adds disk-write quotas to Defender’s engine processes, capping the total data any single scan or quarantine event can write to disk in a defined timeframe.
2. Restricts the privilege level under which certain logging operations run, preventing the engine from bypassing standard OS disk-space guardrails.
3. Improves input validation on scan triggers, so a crafted remote payload can no longer cause the engine to enter an unbounded write loop.

Alongside CVE-2026-33825, the same update also addressed a related privilege escalation bug tracked as CVE-2026-41091, which affected Microsoft Malware Protection Engine version 1.1.26030.3008 and allowed attackers to gain administrative control even when real-time protection appeared to be functioning normally. Patching both simultaneously was the right call.

For background on how Microsoft’s Malware Protection Engine underpins Defender’s scanning capabilities, Microsoft’s official Defender documentation provides a clear technical overview of the engine architecture and how automatic updates work.

How to Verify Your System Is Protected Against the Defender Disk Space Bug

Checking whether the Defender disk space bug patch has been applied is straightforward — you just need to confirm your engine version. Follow these steps:

1. Open Windows Security from the Start menu or system tray.
2. Click Virus & threat protection, then scroll down to Virus & threat protection updates.
3. Click Check for updates and allow any pending definition and engine updates to install.
4. Return to that screen and click Protection updates. Look for the Antimalware Client Version and the Engine Version.
5. Confirm the Engine Version reads 1.1.26060.x or higher. If it does, the CVE-2026-33825 patch is applied.

Alternatively, open PowerShell as Administrator and run:

Get-MpComputerStatus | Select-Object AMEngineVersion, AMProductVersion

The AMEngineVersion field will show the currently installed engine version at a glance. Any version at or above 1.1.26060 confirms you are protected.

What to Do If You Are Still Vulnerable

If your engine version is below the patched threshold, take these steps immediately:

• Force a Windows Update: Go to Settings → Windows Update → Check for updates. Install all pending updates, including optional security updates.
• Manually trigger a Defender update: Open Windows Security → Virus & threat protection → Protection updates → Check for updates.
• Check your internet connection: Defender pulls engine updates automatically, but a broken connection or metered network setting can silently block them.
• Temporarily monitor disk usage: Open Task Manager and keep an eye on disk write activity from MsMpEng.exe (the Defender engine process). Abnormally high sustained writes are a red flag.
• Contact your IT department if you are on a corporate device — enterprise environments may manage Defender engine updates through WSUS or Microsoft Endpoint Configuration Manager on a separate schedule.

Is Windows 11 Safer Than Windows 10 Against This Defender Flaw?

Both Windows 10 and Windows 11 were equally vulnerable to this specific Windows Defender flaw because the attack targets the shared Malware Protection Engine, not OS-level architecture differences. However, Windows 11 does include additional hardware-rooted security features — such as TPM 2.0 enforcement, Secure Boot, and Virtualization-Based Security (VBS) — that can limit the blast radius of other exploit types. For this particular bug, those features offered no meaningful protection.

That said, keeping your OS on its most current version is always sound practice. If you are still on Windows 10 and thinking about upgrading, our Windows 11 Pro licence category has options from as little as €12.90 — a small investment compared to the cost of a compromised or unusable system.

For those who want to understand compatibility before committing, we also have a dedicated guide on checking Windows 11 system requirements before you upgrade — worth reading if your hardware is a few years old.

Broader Lessons from the Windows Defender Disk Space Vulnerability

The CVE-2026-33825 episode reinforces a truth that security professionals repeat but many users still underestimate: security software is itself an attack surface. The same elevated privileges that allow Defender to intercept and neutralise threats are the very reason a flaw in Defender can cause such catastrophic damage. Antivirus products from every vendor have faced similar issues over the years — this is not a reason to abandon Defender, but it is a reason to treat its updates with the same urgency you give OS-level patches.

Key takeaways for any Windows user:

• Automatic updates should be on at all times — engine definition updates arrive independently of monthly Patch Tuesday cycles, and the gap between vulnerability disclosure and patch deployment is exactly when attackers strike.
• Monitor your disk usage periodically. A drive filling up with no obvious cause is a reliable early warning signal of either a disk-related exploit or a rogue process.
• Consider layered security. Defender provides a solid baseline, but pairing it with good browsing habits, a hardware firewall, and regular system backups significantly raises the bar for any attacker.
• Stay informed. Out-of-band updates like the one addressing this flaw are rare and published in Microsoft’s Security Response Center — bookmarking it costs nothing and could save you a disaster.

Frequently Asked Questions

What exactly is the Windows Defender disk space vulnerability (CVE-2026-33825)?

CVE-2026-33825 is a flaw in Microsoft’s Malware Protection Engine — the scanning core shared by Windows Defender, Microsoft Security Essentials, and Endpoint Protection — that lets a remote attacker cause Defender to write unlimited data to your hard drive. The result is a completely full disk, which prevents the system from operating normally. Microsoft released an out-of-band patch in July 2026 to fix it.

Does the Defender disk space bug affect Windows 10 only, or Windows 11 too?

Both are affected. The vulnerability lives in the Malware Protection Engine, which is shared across Windows 10 and Windows 11. Neither OS version provides inherent protection against this specific flaw — only applying the engine update (version 1.1.26060 or higher) resolves it.

How quickly does Windows Defender update its engine automatically?

Defender engine and definition updates are typically delivered within hours of release via Windows Update and Microsoft Update servers. However, the update can be delayed on metered connections, managed enterprise environments, or devices with Windows Update paused. This is why manually checking for updates immediately after a critical advisory is always a good idea.

Can I tell if my disk was already attacked before I patched?

If your system drive filled up unexpectedly around July 2026 with no obvious cause, and disk write activity from MsMpEng.exe was unusually high, there is cause for concern. Run a full Defender scan after patching, check Windows Event Viewer under Windows Logs → Application for Defender-related errors, and consider running the Windows Disk Cleanup tool to reclaim space before investigating further.

Should I switch from Windows Defender to a third-party antivirus because of this flaw?

Not necessarily. Every major antivirus product has had critical vulnerabilities over the years — this is not unique to Defender. Defender’s integration with Windows, its automatic engine updates, and its zero additional cost make it a strong baseline for most users. What this incident highlights is the importance of keeping auto-updates enabled and monitoring your system health, regardless of which AV you use.

Is there a known CVE number for the related privilege escalation bug mentioned alongside CVE-2026-33825?

Yes — the companion vulnerability is tracked as CVE-2026-41091. It is a separate privilege escalation flaw in the same Microsoft Malware Protection Engine that allowed attackers to gain administrative control even when real-time protection appeared operational. Both CVE-2026-33825 and CVE-2026-41091 were addressed together in Microsoft’s July 2026 out-of-band security update.