"Download More RAM" Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing (CVE-2026-23670)
"Download More RAM" Attack Bypasses Windows VBS and Disables (TL-2026-2039), also tracked as Download More RAM, is a medium-severity software vulnerability scored CVSS 5.7, first published 2026-08-17. It has no confirmed attribution, affects Microsoft Windows Virtualization-Based Security (VBS) / HVCI, references 1 CVE (CVE-2026-23670), maps to 9 MITRE ATT&CK techniques (T1003.004, T1014, T1059), and is covered by 9 detection rules and 5 indicators of compromise.
Key facts for TL-2026-2039
- Threat ID
- TL-2026-2039
- Also known as
- Download More RAM
- Severity
- MEDIUM
- CVSS
- 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-08-17
- Last reviewed
- 2026-08-17
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, gaming, enterprise, government administration, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 5
Malware and tooling in "Download More RAM" Attack Bypasses Windows VBS and Disables
Malware and tooling: Windows10
Researchers from the University of Birmingham and Durham University (USENIX Security 2026, Distinguished Paper Award) showed that writable Serial Presence Detect (SPD) EEPROM data on common consumer DDR4/DDR5 memory modules can be rewritten purely in software by a local administrator to falsify reported RAM geometry, producing memory aliasing where two distinct physical addresses resolve to the same underlying DRAM. Using the aliased region, the attackers patched the Secure Kernel Code Integrity library (skci.dll) to disable the vulnerable-driver blocklist, then loaded a signed-but-vulnerable driver to obtain arbitrary physical memory read/write, defeating Virtualization-Based Security (VBS), Hypervisor-Enforced Code Integrity (HVCI), Microsoft Defender, Sophos Intercept X, and the kernel-mode anti-cheats Riot Vanguard, Easy Anti-Cheat, and BattlEye. Microsoft tracked the underlying VBS enclave pointer-dereference weakness as CVE-2026-23670 (CVSS 3.1 5.7 MEDIUM) and shipped a mitigation in the April 2026 security update that disables the Secure-Boot-compatible `removememory` boot parameter used to stabilize the alias; Secure Boot-enabled, patched systems are protected against the demonstrated attack chain, but the researchers note the underlying SPD write-protection weakness persists and alternate stabilization techniques could revive it.
How "Download More RAM" Attack Bypasses Windows VBS and Disables works
"Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory" is a USENIX Security 2026 paper (Distinguished Paper Award, presented 2026-08-13) by Sam Collins (lead author), William Burgess, Prof. Tom Chothia, and Dr. Marius Muench of the University of Birmingham, with David Oswald of Durham University. The paper is a purely software-driven, local-privilege-escalation/security-feature-bypass technique against Windows 10/11 and Windows Server that requires no physical hardware access — per lead author Tom Chothia, "previous attacks needed physical access; this one needs only a script."
Serial Presence Detect (SPD) is configuration data stored in an EEPROM on a DDR4/DDR5 DIMM that tells motherboard firmware and the OS the module's capacity, timings, and layout. On DIMMs where the SPD EEPROM is not write-protected (the researchers surveyed products from Corsair, G.Skill, and ADATA — collectively characterized as roughly 55% of the high-performance consumer memory market and 70% of the gaming memory market — and found writable SPD by default, versus partial protection on some Kingston, Crucial, and HyperX lines and select G.Skill lines; the survey was explicitly not exhaustive), an attacker who already holds local administrator privileges can rewrite the SPD data over the standard SMBus/I2C interface — the same interface consumer RGB/overclocking utilities such as Corsair iCUE and HWiNFO already use to read and, on some vendors, write module configuration. Inflating the reported capacity (roughly 2x in the demonstrated PoC) causes Windows to map a physical DRAM range at two different physical addresses simultaneously: a legitimate one and a falsified "alias."
The demonstrated attack chain has six stages: (1) rewrite SPD data and reboot to create the memory alias; (2) stabilize the system by preventing Windows from allocating out of the falsified/aliased upper memory region (the researchers used the Secure-Boot-compatible `removememory` boot configuration parameter for this, since the more common `badmemory`/`truncatememory` mechanisms are blocked under Secure Boot); (3) use legitimate signed tooling plus an insecure RAM-disk driver application to read the now-accessible aliased region, which overlaps memory used by VBS-protected (Virtual Trust Level) processes; (4) write into the aliased region to modify VBS-protected memory contents; (5) locate and patch the Secure Kernel Code Integrity library (skci.dll) in the aliased copy so that it reports every submitted kernel driver as compliant/"OK," disabling Microsoft's vulnerable/blocked driver list enforcement; (6) load a previously-blocklisted but validly-signed vulnerable driver to obtain a stable, general-purpose arbitrary physical-memory read/write primitive outside the alias. From that primitive the researchers demonstrated tampering with and disabling Microsoft Defender, Sophos Intercept X, and the kernel-mode anti-cheat engines Riot Vanguard, Easy Anti-Cheat, and BattlEye; re-enabling hundreds of Microsoft's blocklisted vulnerable drivers; breaking into VBS enclaves to access protected secrets (the class of data VBS/Credential Guard isolates via LSA Secrets); and compromising enterprise device-management and Group Policy guarantees that assume VBS-backed tamper resistance. The team built a one-click automation script chaining alias creation, reboot, and AV/EDR disablement with no further user interaction after initial execution.
Microsoft assigned CVE-2026-23670, described as an untrusted pointer dereference (CWE-822) in the Windows VBS enclave allowing an authorized (i.e., already-privileged) local attacker to bypass a security feature, CVSS 3.1 5.7 (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N). The April 2026 Windows security update mitigates the specific demonstrated path by making the `removememory` boot parameter unavailable when Secure Boot is enabled (it is now silently ignored rather than removed outright on Secure-Boot systems). Machines with Secure Boot enabled and the April 2026 update installed are protected against the attack chain as demonstrated; machines without Secure Boot, or using an as-yet-undemonstrated alternative stabilization technique, remain exposed to the same class of memory-aliasing weakness because the root cause — unauthenticated, writable SPD configuration data — is a hardware/firmware supply-chain issue outside Microsoft's control. The researchers and reporting note this is not remediated at the DIMM level; defenders are advised to enable SPD write-protection in BIOS/UEFI or vendor utilities (e.g., Corsair iCUE, HWiNFO) where available, in addition to keeping Secure Boot on and Windows patched.
MITRE ATT&CK techniques used in TL-2026-2039
Credential Access
Defense Evasion
Execution
T1059 Command and Scripting Interpreter
defense-impairment
T1484.001 Group Policy Modification; T1553.006 Code Signing Policy Modification; T1685 Disable or Modify Tools
Impact
Persistence
T1542.001 System Firmware; T1547.006 Kernel Modules and Extensions
Privilege Escalation
Affected products and versions in "Download More RAM" Attack Bypasses Windows VBS and Disables
- Microsoft — Windows Virtualization-Based Security (VBS) / HVCI
Vulnerable versions: Windows 10 1607; Windows 10 1809; Windows 10 21H2; Windows 10 22H2; Windows 11 23H2; Windows 11 24H2; Windows 11 25H2; Windows 11 26H1; Windows Server 2016 and later
Fixed in: April 2026 cumulative security update, effective only with Secure Boot enabled - Corsair — Consumer DDR4/DDR5 memory modules (SPD EEPROM)
Vulnerable versions: Product lines tested by USENIX researchers with writable SPD by default - G.Skill — Consumer DDR4/DDR5 memory modules (SPD EEPROM)
Vulnerable versions: Product lines tested by USENIX researchers with writable SPD by default - ADATA — Consumer DDR4/DDR5 memory modules (SPD EEPROM)
Vulnerable versions: Product lines tested by USENIX researchers with writable SPD by default - Sophos — Intercept X
Vulnerable versions: Versions relying on Windows VBS/HVCI-protected process integrity, tested by researchers - Riot Games — Vanguard anti-cheat
Vulnerable versions: Kernel-mode driver relying on VBS/HVCI-protected integrity, tested by researchers - Epic Games — Easy Anti-Cheat
Vulnerable versions: Kernel-mode driver relying on VBS/HVCI-protected integrity, tested by researchers - BattlEye — BattlEye anti-cheat
Vulnerable versions: Kernel-mode driver relying on VBS/HVCI-protected integrity, tested by researchers
Remediation for "Download More RAM" Attack Bypasses Windows VBS and Disables
Patches
- Microsoft April 2026 security update for CVE-2026-23670 (Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2016 and later per MSRC advisory)
Immediate actions
- Install the April 2026 Windows cumulative security update, which mitigates CVE-2026-23670 by disabling the Secure-Boot-compatible `removememory` boot parameter used in the demonstrated attack path
- Ensure UEFI Secure Boot is enabled on all Windows endpoints and servers; unpatched or Secure-Boot-disabled systems remain exposed to the demonstrated chain
- Review BIOS/UEFI settings for SPD write-protection options on installed DDR4/DDR5 memory modules and enable them where offered
Workarounds
- Enable Corsair iCUE or HWiNFO write-protection options on supported memory modules to prevent runtime SPD rewriting
- Disable or restrict the `removememory`/related boot-configuration parameters via Group Policy or BCD auditing on systems that cannot yet be patched
Longer-term hardening
- Inventory installed DIMMs by vendor/model and prioritize replacement or firmware mitigation for modules with confirmed writable SPD EEPROMs (Corsair, G.Skill, ADATA product lines flagged in the research)
- Engage memory vendors for guidance on enabling or enforcing SPD write protection; treat SPD write-protection status as a procurement criterion for new hardware
- Monitor for and restrict use of vendor RGB/overclocking utilities (e.g., Corsair iCUE, HWiNFO) that expose SMBus/I2C SPD write access on hosts where they are not operationally required
- Track USENIX Security 2026 follow-on research for alternative memory-stabilization techniques that could revive the attack chain post-patch
CVEs associated with "Download More RAM" Attack Bypasses Windows VBS and Disables
Weaknesses (CWE) in "Download More RAM" Attack Bypasses Windows VBS and Disables
CWE-822
Timeline of "Download More RAM" Attack Bypasses Windows VBS and Disables
- Microsoft ships mitigation for CVE-2026-23670 in the April 2026 Windows security update ahead of public disclosure, disabling the Secure-Boot-compatible `removememory` boot parameter used in the demonstrated attack path.
- Paper discloses a one-click automation script chaining SPD rewrite, reboot-based stabilization via the `removememory` boot parameter, skci.dll patching, vulnerable-driver-blocklist bypass, and AV/EDR/anti-cheat disablement with no further user interaction.
- Paper discloses that researchers surveyed consumer DDR4/DDR5 modules from Corsair, G.Skill, and ADATA and found writable SPD EEPROM by default, versus partial protection on some Kingston, Crucial, and HyperX product lines (survey explicitly non-exhaustive).
- "Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory" presented at USENIX Security 2026 by Sam Collins, William Burgess, Tom Chothia, and Marius Muench (University of Birmingham) with David Oswald (Durham University); the paper received a Distinguished Paper Award.
- Follow-on coverage (Windows Report, Neowin, Tech2Geek) clarifies the attack needs no physical hardware access — only pre-existing local administrator code execution — and surveys mitigation options including Corsair iCUE and HWiNFO write-protection settings.
- University of Birmingham publishes a press release quoting Prof. Tom Chothia ("previous attacks needed physical access; this one needs only a script") and detailing additional demonstrated capabilities beyond AV/anti-cheat disablement: re-enabling hundreds of blocklisted vulnerable drivers, breaking into VBS enclaves to access protected secrets, and compromising enterprise device-management/Group Policy guarantees; it also gives market-share context (roughly 55% of high-performance consumer and 70% of gaming memory using unprotected SPD).
- Cyber Security News, GBHackers, and Cyberpress publish coverage of the attack, its six-stage exploit chain, and the affected security products.
Sources cited for "Download More RAM" Attack Bypasses Windows VBS and Disables
- Download More RAM Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing
- Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory (USENIX Security 2026)
- Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory — Presentation page
- Attackers can bypass Microsoft's flagship Windows security defences without physical access
- New "Download More RAM" Attack Breaks Windows VBS and Disables EDR Protections
- Download More RAM Attack Bypasses Windows VBS, HVCI and Disables Microsoft Defender
- New "Download More RAM" Attack Can Bypass Windows Security
- Windows 11 Security Bypass Can Fake Your RAM and Disable Key Protections
- Researchers find Windows 11 can be hacked with no physical access with new attack
- CVE-2026-23670 — NVD
- CVE-2026-23670 — MSRC Security Update Guide
- Boot Parameters to Manipulate Memory — Windows Drivers
Threats related to "Download More RAM" Attack Bypasses Windows VBS and Disables
- 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure Boot Bypass (CVE-2026-8863, CVE-2026-10797)
- Dell BIOS Flaw (CVE-2026-40639 / DSA-2026-197) Lets Attackers Recover Admin Passwords From SPI Flash
- usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple A12/A12X/A12Z/A13 and S4/S5 Chips Bypassing Secure Boot
- Forgotten UEFI Shims Undermine Secure Boot (CVE-2026-8863, CVE-2026-10797)
Detection coverage for TL-2026-2039
As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2039 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.