New Windows Exploit "Download More RAM" Exposes Significant Security Vulnerabilities
A recently unveiled attack technique, termed "Download More RAM," poses a substantial threat to Microsoft’s Virtualization-Based Security (VBS). This technique effectively bypasses Hypervisor-Protected Code Integrity (HVCI) and can disable various endpoint protections, including Microsoft Defender and other third-party Endpoint Detection and Response (EDR) solutions.
This alarming discovery was made during a presentation at the USENIX Security conference in 2026, and it has been assigned the identifier CVE-2026-23670 by Microsoft. Unlike traditional Windows kernel exploits that typically focus on software vulnerabilities, "Download More RAM" uniquely leverages a hardware configuration flaw found in certain consumer DDR4 and DDR5 memory modules.
At the core of this attack is the manipulation of the Serial Presence Detect (SPD) data, which is a type of configuration information stored in an Electrically Erasable Programmable Read-Only Memory (EEPROM) on a Dual In-line Memory Module (DIMM). The SPD provides essential details to motherboard firmware, such as the memory module’s capacity, arrangement, speed, and functional parameters.
A Closer Look at the Attack
If the SPD EEPROM lacks adequate write protection, an attacker possessing local administrator privileges can modify the reported geometry of the DIMM, leading the system to mistakenly believe that more RAM is installed than what is physically present. In their demonstrations, researchers succeeded in manipulating a system to report nearly double the actual RAM capacity of the compromised memory module.
This alteration creates a phenomenon known as memory aliasing, wherein Windows interprets multiple physical addresses as separate locations, despite them linking back to the same underlying DRAM cells. Such distortions undermine a fundamental assumption made by the operating system, processor, and hypervisor.
Remarkably, researchers from USENIX identified a method to stabilize the operating system, using this overlapping address space to access critical memory regions that should remain isolated. The title "Download More RAM" aptly captures the essence of this exploit— it allows the system to appear as though it has more RAM purely through software manipulation without necessitating any physical reconfiguration of the DIMM.
Impact on Security Mechanisms
VBS uses Hyper-V along with Virtual Trust Levels to safeguard sensitive components from interference by the conventional Windows kernel. These protected elements may comprise the Secure Kernel, Credential Guard, and various security-critical processes that execute at a higher Virtual Trust Level. The researchers’ technique enables access to physical memory areas that even a privileged Windows administrator cannot typically read or alter.
The proof-of-concept exploit reportedly utilized legitimate, signed tools to inspect aliased memory alongside a RAM-disk method for applying targeted changes to specific memory regions. Additionally, the team modified the Secure Kernel Code Integrity library, known as skci.dll, effectively disabling the checks that enforce Microsoft’s vulnerable-driver blocklist. This loophole allowed the load of legitimate but compromised drivers capable of exploiting physical memory read and write capabilities, thus breaching the security boundaries intended by VBS and HVCI.
The ramifications were severe, as USENIX illustrated scenarios that included disabling Microsoft Defender protections, impacting configurations for Sophos Intercept X, modifying code within VBS-protected enclaves, and interfering with kernel-level anti-cheat systems.
Vendor Implications and Responses
Investigations revealed writable SPD configurations in specific consumer products from brands such as Corsair, G.Skill, and ADATA. However, the survey was not exhaustive, and the susceptibility to this software-only attack may vary based on vendor, product line, model, and firmware configuration. DIMMs equipped with properly write-protected SPD blocks are not at risk of this exploit.
In response to CVE-2026-23670, Microsoft released a mitigation during its April 2026 security updates. This fix effectively nullifies the Secure Boot-compatible removememory boot configuration mechanism, which researchers had employed to stabilize Windows during the demonstration.
Furthermore, systems updated with Secure Boot enabled are now protected against the described attack chain. Organizations are urged to implement the latest Windows security updates promptly, confirm that Secure Boot is activated, and monitor systems for any unexpected alterations to boot configurations.
Security teams are also encouraged to scrutinize motherboard BIOS or UEFI settings for SPD write-protection options and seek guidance from vendors about installed RAM modules. Monitoring efforts should concentrate on identifying attempts to load vulnerable drivers, detecting unusual kernel memory access patterns, and observing administrative changes to boot or memory settings.
Despite Microsoft’s update disrupting the disclosed technique, the underlying hardware concern regarding writable SPD persists. Therefore, write protection of SPD should be regarded as a necessary security measure, complementing operating-system patching efforts rather than serving as the sole line of defense. Organizations must prioritize a defense-in-depth strategy to safeguard their systems against potential future exploits.