When you buy through links on our articles, Future and its syndication partners may earn a commission.
- Researchers uncovered “Download more RAM” flaw in consumer DDR4/DDR5 memory
- Attack bypassed Windows VBS and HVCI, disabling antivirus and protections
- Microsoft patched CVE‑2026‑23670; tools now help enable memory write protection
In a significant development for cybersecurity, Microsoft has addressed a vulnerability that allowed malicious actors to circumvent advanced security protocols, disable antivirus software, and potentially seize control of affected devices. This vulnerability, discovered by ethical hackers, was reported to Microsoft and swiftly patched, averting a potential crisis.
Download more RAM
During the recent 2026 USENIX Security Symposium, researchers from the University of Birmingham and Durham University unveiled their findings on a vulnerability they dubbed “Download more RAM.” Their research revealed that certain consumer memory chips, specifically DDR4 and DDR5 DIMMs, could be manipulated to misreport their configuration to the motherboard. This manipulation could lead a computer to believe it possesses double the actual RAM, creating a false sense of capacity.
The implications of this flaw are profound. The researchers demonstrated that this fictitious additional memory could act as an alias for legitimate memory locations, enabling unauthorized access to read and modify memory allocations that should be safeguarded by both the processor and Windows operating system. This breach allowed them to bypass critical security features such as Virtualization-based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI), both designed to protect the system from unauthorized code execution.
Furthermore, the researchers exploited this vulnerability to disable antivirus and endpoint detection and response (EDR) software, reinstate outdated and vulnerable drivers, compromise systems under lockdown, and evade kernel-level game anti-cheat mechanisms. Alarmingly, this entire process could be executed with a single click, provided the victim unwittingly runs a malicious script.
Professor Tom Chothia from the University of Birmingham remarked, “Our work exploits the fact that all processes share the same memory to bypass Windows’ strongest security guarantees. Previous attacks of this kind required physical access to the machine; this one just needs a script, broadening the scope of potential attackers.”
Who is vulnerable and how to stay safe
The attack surface is extensive, with researchers identifying three major manufacturers—Corsair, G.Skill, and ADATA—shipping consumer memory products that lack adequate protection on their configuration chips. Collectively, these companies dominate over half (55%) of the high-performance consumer memory market and more than 70% of the gaming sector. While not all products from these manufacturers are vulnerable, the findings underscore a significant risk in the market.
Modules from Crucial, Kingston, and HyperX, along with certain G.Skill lines, employ partial write protection, providing a layer of security. Before making their findings public, the researchers disclosed the vulnerability to Microsoft, which promptly addressed it. The flaw is now cataloged as CVE-2026-23670 and is described on the National Vulnerability Database (NVD) as an “untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave,” allowing local bypass of security features by authorized attackers. The vulnerability received a medium severity score of 5.7/10 and was rectified in the April 2026 Patch Tuesday cumulative update, ensuring that systems with Secure Boot enabled are now protected.
In response to the vulnerability, Corsair has introduced a feature in its iCue tools that allows users to retroactively enable write protection on their memory modules. Additionally, a free tool called HWinfo offers similar functionality, providing a safeguard for non-Corsair models. Some motherboards also feature BIOS settings that can block writes to memory configuration chips, serving as a temporary measure for users.
Dr. Marius Muench, also from the University of Birmingham, emphasized the importance of understanding system security, stating, “The ‘Download More RAM’ attack illustrates that if a lower layer can be compromised, it jeopardizes the entire system.” He further noted, “Windows makes a strong promise: that even an attacker with administrator rights can’t touch the secure kernel. We found that promise rests on the assumption that your memory is telling the truth about itself—on much of the memory people actually buy, it doesn’t have to.”
