Windows’ strongest security layer rests on an assumption about memory that many PCs don’t meet. At the USENIX Security Symposium in Baltimore, researchers from the University of Birmingham and Durham University presented “Download More RAM,” a software-only attack that defeats Virtualization-Based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI) on systems running common consumer memory.
The trick targets the configuration chip on DIMMs, which tells the computer how much memory is installed. On many modules that chip has no write protection, so software can rewrite it and make the machine “see” twice as much RAM as it has. The extra addresses become aliases for real memory, giving an attacker a way around the access controls the OS and processor enforce, the University of Birmingham said.
“Previous attacks of this kind needed a screwdriver and physical access to the machine. This one just needs a script. That changes who can carry it out and how far it can spread,” said Professor Tom Chothia.
What an attacker can do
The attack needs a privileged user to start. The paper describes it as letting “a privileged user compromise the OS at every level, including the secure kernel.” That matters because VBS exists to keep even administrators out of the secure kernel. With arbitrary memory read and write, the team showed it could:
– disable antivirus and EDR software, including Windows Defender – re-enable hundreds of blocked, known-vulnerable drivers used in past malware and ransomware campaigns – read secrets from VBS-protected enclaves – compromise locked-down machines configured like typical enterprise or university deployments – bypass kernel-level game anti-cheat systems
The researchers also built a one-click script that aliases memory, reboots and disables antivirus with no further user interaction, which they say makes the attack suitable for automated, large-scale campaigns. TechRadar noted it affects Windows 10 and later.
Which memory is exposed
The team found that Corsair, G.Skill and ADATA each ship at least one product line with the configuration chip left fully unprotected, contrary to JEDEC guidance. Those three account for 55% of the high-performance consumer memory market and more than 70% of the gaming segment, according to the university. Modules from Crucial, Kingston and HyperX, plus some G.Skill lines, use partial write protection, which is enough to block the attack.
Microsoft assigned CVE-2026-23670 and issued a patch that, in the paper’s words, “partially mitigates our attack.” Admins should make sure that patch is installed, treat local admin rights on enthusiast-grade hardware as a bigger risk than VBS alone would suggest, and favor memory with SPD write protection in new purchases. “Microsoft VBS blindly trusted the shaky ground it stood on,” said lead author Sam Collins.
WebProNews is an iEntry Publication