# "Download More RAM" Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing (CVE-2026-23670)

> Researchers from the University of Birmingham and Durham University (USENIX Security 2026, Distinguished Paper Award) showed that writable Serial Presence Detect (SPD) EEPROM data on common consumer DDR4/DDR5 memory modules can be rewritten purely in software by a local administrator to falsify reported RAM geometry, producing memory aliasing where two distinct physical addresses resolve to the same underlying DRAM. Using the aliased region, the attackers patched the Secure Kernel Code Integrity library (skci.dll) to disable the vulnerable-driver blocklist, then loaded a signed-but-vulnerable driver to obtain arbitrary physical memory read/write, defeating Virtualization-Based Security (VBS), Hypervisor-Enforced Code Integrity (HVCI), Microsoft Defender, Sophos Intercept X, and the kernel-mode anti-cheats Riot Vanguard, Easy Anti-Cheat, and BattlEye. Microsoft tracked the underlying VBS enclave pointer-dereference weakness as CVE-2026-23670 (CVSS 3.1 5.7 MEDIUM) and shipped a mitigation in the April 2026 security update that disables the Secure-Boot-compatible `removememory` boot parameter used to stabilize the alias; Secure Boot-enabled, patched systems are protected against the demonstrated attack chain, but the researchers note the underlying SPD write-protection weakness persists and alternate stabilization techniques could revive it.

- **Published:** 2026-08-17T00:00:00Z
- **Last reviewed:** 2026-08-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2039
- **ID:** TL-2026-2039
- **Severity:** MEDIUM (CVSS 5.7)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-23670

## Description

"Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory" is a USENIX Security 2026 paper (Distinguished Paper Award, presented 2026-08-13) by Sam Collins (lead author), William Burgess, Prof. Tom Chothia, and Dr. Marius Muench of the University of Birmingham, with David Oswald of Durham University. The paper is a purely software-driven, local-privilege-escalation/security-feature-bypass technique against Windows 10/11 and Windows Server that requires no physical hardware access — per lead author Tom Chothia, "previous attacks needed physical access; this one needs only a script."

Serial Presence Detect (SPD) is configuration data stored in an EEPROM on a DDR4/DDR5 DIMM that tells motherboard firmware and the OS the module's capacity, timings, and layout. On DIMMs where the SPD EEPROM is not write-protected (the researchers surveyed products from Corsair, G.Skill, and ADATA — collectively characterized as roughly 55% of the high-performance consumer memory market and 70% of the gaming memory market — and found writable SPD by default, versus partial protection on some Kingston, Crucial, and HyperX lines and select G.Skill lines; the survey was explicitly not exhaustive), an attacker who already holds local administrator privileges can rewrite the SPD data over the standard SMBus/I2C interface — the same interface consumer RGB/overclocking utilities such as Corsair iCUE and HWiNFO already use to read and, on some vendors, write module configuration. Inflating the reported capacity (roughly 2x in the demonstrated PoC) causes Windows to map a physical DRAM range at two different physical addresses simultaneously: a legitimate one and a falsified "alias."

The demonstrated attack chain has six stages: (1) rewrite SPD data and reboot to create the memory alias; (2) stabilize the system by preventing Windows from allocating out of the falsified/aliased upper memory region (the researchers used the Secure-Boot-compatible `removememory` boot configuration parameter for this, since the more common `badmemory`/`truncatememory` mechanisms are blocked under Secure Boot); (3) use legitimate signed tooling plus an insecure RAM-disk driver application to read the now-accessible aliased region, which overlaps memory used by VBS-protected (Virtual Trust Level) processes; (4) write into the aliased region to modify VBS-protected memory contents; (5) locate and patch the Secure Kernel Code Integrity library (skci.dll) in the aliased copy so that it reports every submitted kernel driver as compliant/"OK," disabling Microsoft's vulnerable/blocked driver list enforcement; (6) load a previously-blocklisted but validly-signed vulnerable driver to obtain a stable, general-purpose arbitrary physical-memory read/write primitive outside the alias. From that primitive the researchers demonstrated tampering with and disabling Microsoft Defender, Sophos Intercept X, and the kernel-mode anti-cheat engines Riot Vanguard, Easy Anti-Cheat, and BattlEye; re-enabling hundreds of Microsoft's blocklisted vulnerable drivers; breaking into VBS enclaves to access protected secrets (the class of data VBS/Credential Guard isolates via LSA Secrets); and compromising enterprise device-management and Group Policy guarantees that assume VBS-backed tamper resistance. The team built a one-click automation script chaining alias creation, reboot, and AV/EDR disablement with no further user interaction after initial execution.

Microsoft assigned CVE-2026-23670, described as an untrusted pointer dereference (CWE-822) in the Windows VBS enclave allowing an authorized (i.e., already-privileged) local attacker to bypass a security feature, CVSS 3.1 5.7 (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N). The April 2026 Windows security update mitigates the specific demonstrated path by making the `removememory` boot parameter unavailable when Secure Boot is enabled (it is now silently ignored rather than removed outright on Secure-Boot systems). Machines with Secure Boot enabled and the April 2026 update installed are protected against the attack chain as demonstrated; machines without Secure Boot, or using an as-yet-undemonstrated alternative stabilization technique, remain exposed to the same class of memory-aliasing weakness because the root cause — unauthenticated, writable SPD configuration data — is a hardware/firmware supply-chain issue outside Microsoft's control. The researchers and reporting note this is not remediated at the DIMM level; defenders are advised to enable SPD write-protection in BIOS/UEFI or vendor utilities (e.g., Corsair iCUE, HWiNFO) where available, in addition to keeping Secure Boot on and Windows patched.

## MITRE ATT&CK

- T1685 Disable or Modify Tools
- T1553.006 Code Signing Policy Modification
- T1014 Rootkit
- T1484.001 Group Policy Modification
- T1547.006 Kernel Modules and Extensions
- T1547.006 Kernel Modules and Extensions
- T1542.001 System Firmware
- T1003.004 LSA Secrets
- T1059 Command and Scripting Interpreter
- T1495 Firmware Corruption

## Sources

- [Download More RAM Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing](https://cybersecuritynews.com/download-more-ram-attack/)
- [Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory (USENIX Security 2026)](https://www.usenix.org/system/files/usenixsecurity26-collins.pdf)
- [Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory — Presentation page](https://www.usenix.org/conference/usenixsecurity26/presentation/collins)
- [Attackers can bypass Microsoft's flagship Windows security defences without physical access](https://www.birmingham.ac.uk/news/2026/attackers-can-bypass-microsofts-flagship-windows-security-defences-without-physical-access)
- [New "Download More RAM" Attack Breaks Windows VBS and Disables EDR Protections](https://cyberpress.org/new-download-more-ram-attack-breaks-windows-vbs/)
- [Download More RAM Attack Bypasses Windows VBS, HVCI and Disables Microsoft Defender](https://gbhackers.com/download-more-ram-attack-bypasses-windows-vbs/)
- [New "Download More RAM" Attack Can Bypass Windows Security](https://windowsreport.com/new-download-more-ram-attack-can-bypass-windows-security/)
- [Windows 11 Security Bypass Can Fake Your RAM and Disable Key Protections](https://www.tech2geek.net/windows-11-security-bypass-can-fake-your-ram-and-disable-key-protections/)
- [Researchers find Windows 11 can be hacked with no physical access with new attack](https://www.neowin.net/news/researchers-find-windows-11-can-be-hacked-with-no-physical-access-with-new-attack/)
- [CVE-2026-23670 — NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-23670)
- [CVE-2026-23670 — MSRC Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23670)
- [Boot Parameters to Manipulate Memory — Windows Drivers](https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/boot-parameters-to-manipulate-memory)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2039