Experts have shown that the most powerful security defences in Windows 11 can be dismantled by an attacker who never touches the target computer.
Presenting their findings today (13 Aug) at the 2026 USENIX Security Symposium, in Baltimore, researchers from the University of Birmingham and Durham University reveal a major flaw in the trust assumptions underpinning modern Windows security.
Their award-winning research shows that some consumer memory modules let an attacker bypass security protections Windows relies on, with no physical access to the machine. The attack, named ‘Download More RAM’, exploits the fact that many Dual In-line Memory Modules (DIMM) have no write protection on the configuration chip telling the computer how much memory is installed.
By rewriting that configuration from software, an attacker can make the machine ‘see’ twice as much memory as it really has. This reveals extra addresses that become aliases for the real ones – creating a backdoor into memory that bypasses every access control the operating system and processor put in place.
Professor Tom Chothia, from the University of Birmingham, said: “Our work exploits the fact that all processes share the same memory to bypass Windows’ strongest security guarantees. Previous attacks of this kind needed a screwdriver and physical access to the machine. This one just needs a script. That changes who can carry it out and how far it can spread.”
By creating ‘memory aliases’, the researchers successfully demonstrated that an attacker can:
- Re-enable hundreds of banned known-vulnerable drivers used in past malware and ransomware campaigns.
- Disable antivirus and Endpoint Detection and Response (EDR) software, which continuously monitors computers, phones, and servers to track activity and stop cyberattacks.
- Break into Virtualisation-based Security (VBS) enclaves – reading the secrets held in Microsoft’s most strongly isolated environments.
- Defeat corporate device management – compromising locked-down machines with group policies mirroring a typical enterprise or university deployment.
- Bypass kernel-level game anti-cheat systems – disabling detection hooks that failed to prevent underlying tampering.
The team also built a one-click script to carry out a whole chain of attack actions – aliasing memory, rebooting, and disabling antivirus – with no user interaction at all, showing the attack is suitable for automated, large-scale campaigns.
Professor Chothia added: “This is a new attack vector that Microsoft seems to have completely overlooked – allowing attackers to bypass the strongest defence that Windows has to offer.”
Lead author Dr Sam Collins, from the University of Birmingham, said: “While RAM misconfiguration was originally a reliability issue, this attack shows the importance of adopting and verifying safety features even when an abuse vector isn’t clear to vendors. In this scenario Microsoft VBS blindly trusted the shaky ground it stood on.”
The researchers surveyed popular consumer DDR4 and DDR5 memory modules and found that three manufacturers – Corsair, G.Skill and ADATA – ship at least one product line with the configuration chip left entirely unprotected, contrary to JEDEC guidance.
Together, these vendors account for 55% of the high-performance consumer memory market and over 70% of the gaming segment. Modules from Crucial, Kingston and HyperX, and some G.Skill lines, were found to use partial write protection, which is sufficient to block the attack.
Researchers were able to read and modify any memory on the system, including memory that Windows guarantees is off-limits even to the operating system itself. This breaks not only VBS, but also Hypervisor Enforced Code Integrity (HVCI) – the technologies Microsoft designed to protect Windows even against attackers with administrator rights.
Dr Marius Muench, from the University of Birmingham, said: “The ‘Download More RAM’ attack demonstrates once more the importance of understanding systems, especially in terms of security guarantees. If a lower layer can become compromised, it puts the full system at risk.
“Windows makes a strong promise: that even an attacker with administrator rights can’t touch the secure kernel. We found that promise rests on the assumption that your memory is telling the truth about itself – on a lot of the memory people actually buy, it doesn’t have to.”
The work follows coordinated disclosure practice: all affected vendors were notified with full technical details well ahead of publication.
Microsoft acknowledged the team’s findings, assigned CVE-2026-23670, and issued mitigations in its April 2026 security updates. Windows machines running with SecureBoot enabled are protected against the attack in its current form. Machines without SecureBoot remain vulnerable, and the research team advises users to ensure that SecureBoot is enabled.
Corsair has added a feature to its iCue tooling that lets owners retroactively enable write protection on their memory modules, closing the hole at the hardware level. The free tool HWinfo has also adopted this functionality, providing mitigation for non-Corsair models. Some motherboards offer a BIOS setting to block writes to memory configuration chips, which users can enable as an interim measure.
