Dateline: August 17, 2026
For years, breaking Windows 11’s deepest protections meant one thing: a screwdriver, an open case, and hands on the machine. That price of entry just dropped to a text file. Researchers from two UK universities have shown that some of the memory sticks sitting inside ordinary desktops and laptops will lie about themselves when asked, and that lie is enough to knock down defenses Microsoft built to survive even an attacker with admin rights.
What Happened?
At the 2026 USENIX Security Symposium in Baltimore, a team from the University of Birmingham and Durham University unveiled an attack they call “Download More RAM.” The name is a joke about an old internet scam, but the mechanics are real. Many DDR4 and DDR5 memory modules carry a tiny configuration chip, the SPD, that tells the computer how much memory it has and how it is laid out. On several consumer product lines, nothing stops software from rewriting that chip.
Overwrite it, and the machine believes it has roughly twice the RAM it actually holds. Those phantom addresses do not point to new memory. They alias real memory already in use, handing an attacker a back door into regions the processor and Windows are supposed to keep sealed.
From there, the team reached inside Virtualization-based Security and Hypervisor-Enforced Code Integrity, two of Microsoft’s strongest boundaries. They killed antivirus and EDR, switched hundreds of blocked vulnerable drivers back on, pulled data out of isolated enclaves, and walked past corporate group-policy locks. They even wrote a script that chains the whole thing together, aliasing memory, rebooting, and disabling protection with no further clicks.
One caveat matters. This is not a remote hack. The attacker must already hold admin-level access. What the flaw does is let that foothold punch through the walls meant to contain it.
What’s the Impact?
The researchers found that vulnerable product lines account for more than half of the high-performance consumer memory market and over 70% of the gaming segment, running counter to JEDEC guidance on write protection. The flaw lives at the memory-module level, not with one brand, so a logo alone tells you nothing.
Microsoft acknowledged the work, assigned it CVE-2026-23670, and shipped mitigations in its April 2026 updates. Machines with Secure Boot enabled are protected against the attack in its current form. Machines without it stay exposed. The paper also earned a Distinguished Paper Award, which tells you how seriously the field took it.
How to Avoid This
- Turn Secure Boot on. It is the clearest line between exposed and protected.
- Then install the latest Windows updates, since they are cumulative and carry the April fix forward.
- On the hardware side, Corsair added SPD write protection to its iCUE software, and the free HWiNFO tool does the same for other vendors.
- Some motherboards let you block writes to the config chip in BIOS.
- Check the write-protection status of your specific memory model rather than trusting the brand.
- And because the attack needs privileged access to begin, watch for sudden AV or EDR silence and unexpected boot-parameter changes.
More from Secure.com
