Microsoft has released security updates to address RoguePlanet, a recently disclosed privilege escalation vulnerability affecting Microsoft Defender. The flaw, tracked as CVE-2026-50656 with a CVSS score of 7.8, impacts the Microsoft Malware Protection Engine (mpengine.dll), the core component responsible for malware scanning, detection, and cleanup.
The vulnerability has been fixed in Microsoft Malware Protection Engine version 1.1.26060.3008, along with additional defense-in-depth improvements designed to strengthen the product’s overall security.
What Is RoguePlanet?
RoguePlanet was publicly disclosed by security researcher Chaotic Eclipse, also known as Nightmare-Eclipse, who described the issue as a race condition vulnerability.
According to the researcher, a successful exploit can allow an attacker to spawn a command shell with SYSTEM-level privileges, giving them complete control over the affected system. With elevated permissions, an attacker could execute arbitrary code, install malicious software, modify sensitive files, or perform other unauthorized actions.
Testing also showed that the exploit works on fully patched Windows systems running the June 2026 Patch Tuesday updates and remains effective regardless of whether Microsoft Defender’s real-time protection is enabled.
Microsoft has not officially credited the researcher for discovering the vulnerability.
Fourth Defender Vulnerability Reported by the Researcher
RoguePlanet is the fourth Microsoft Defender vulnerability publicly disclosed by Chaotic Eclipse. The previous flaws include:
- BlueHammer (CVE-2026-33825)
- UnDefend (CVE-2026-45498)
- RedSun (CVE-2026-41091)
Microsoft has already released fixes for all three previously reported vulnerabilities.
Automatic Updates Protect Most Users
Microsoft stated that no manual action is required for most users, as Defender automatically receives engine updates through its regular update process.
Enterprise deployments and consumer devices configured with default settings typically download the latest malware definitions and protection engine updates several times a day whenever they are connected to the internet. Organizations can also manually check for updates if needed.
Researcher Identifies Potential Side Effect
Following Microsoft’s release of the security update, Chaotic Eclipse reported discovering an unexpected side effect introduced by the new defense-in-depth protections.
According to the researcher, Microsoft Defender may leak 8 bytes of data when attempting to open certain files under specific conditions. While the researcher has not yet found a method for standard users to access the leaked data, it currently appears to be exposed only to kernel drivers.
The researcher also noted that Defender enforces strict limits on file sizes during malware scanning and quarantine operations to prevent excessive disk usage. However, one exception appears to involve Zone.Identifier Alternate Data Stream (ADS) files.
How the Disk Exhaustion Issue Works
A Zone.Identifier file is a hidden metadata stream attached to files downloaded from the internet or received from untrusted sources. It forms part of Windows’ Mark of the Web (MotW) security mechanism, helping applications identify potentially unsafe files.
According to the researcher, this metadata handling behavior can potentially be abused using the Server Message Block (SMB) protocol.
In the demonstrated scenario, a specially crafted SMB server delivers a malicious file alongside an unusually large Zone.Identifier ADS file. By intentionally failing to respond to certain file read requests while keeping the network connection active, Microsoft Defender continues caching the metadata, eventually consuming all available disk space.
Although the attack does not immediately crash Windows, a completely full disk can lead to widespread system instability, causing applications and services to fail unexpectedly.
Windows 11 and Server Versions Affected
The researcher successfully reproduced the disk exhaustion behavior on:
- Windows 11 version 25H2
- Windows Server 2025
Further research is underway to determine whether the same technique can be adapted to work over WebDAV, potentially eliminating the authentication requirements associated with SMB-based attacks.
Final Thoughts
While Microsoft has already patched the RoguePlanet (CVE-2026-50656) privilege escalation vulnerability, ongoing research highlights the complexity of securing modern antivirus software. The reported side effects demonstrate that even security hardening measures can introduce unexpected behaviors requiring further investigation.
Organizations should ensure Microsoft Defender is running the latest protection engine version and continue following security best practices, including timely updates, endpoint monitoring, and layered defense strategies.
