Researchers from the University of Birmingham and Durham University have found a way to knock down some of the toughest protections in Windows 11 without physically opening or modifying the target machine. The attack assumes the attacker has already gained privileged access to the system.
A chip that never checks who’s asking
The attack, named “Download More RAM,” targets a small configuration chip found on Dual In-line Memory Modules (DIMMs), the RAM sticks inside most desktops and laptops. That chip stores information about the memory module, including its capacity and configuration. On several consumer memory modules, nothing stops software from rewriting critical parts of it.
Overview of Download More RAM (Source: Research paper)
An attacker who overwrites that information can make a machine believe it has more memory than it does. The extra addresses don’t correspond to new physical RAM. Instead, some alias memory already in use, allowing accesses that bypass the isolation Windows and the processor normally enforce.
“Our work exploits the fact that all processes share the same memory to bypass Windows’ strongest security guarantees,” said Tom Chothia, professor of cyber security at Birmingham. “Previous attacks of this kind needed a screwdriver and physical access to the machine. This one just needs a script. That changes who can carry it out and how far it can spread.”
From memory aliasing to security bypass
Once the memory aliasing is set up, the team demonstrated they could reach into parts of the system Windows is built to keep off-limits, including memory the operating system itself is not supposed to touch. By creating these memory aliases, the researchers showed an attacker could:
- Turn hundreds of blocklisted drivers with known vulnerabilities back on, including drivers previously associated with malware and ransomware
- Kill antivirus and endpoint detection and response (EDR) software, disabling tools that would normally monitor activity and flag attacks
- Reach inside Virtualisation-based Security (VBS) enclaves and pull out data meant to stay isolated from the rest of the machine
- Get past corporate device-management rules, including group-policy restrictions of the kind used on enterprise and university-managed machines
- Slip past kernel-level anti-cheat protections in games
The break reaches VBS and Hypervisor-Enforced Code Integrity (HVCI), two protections Microsoft built to maintain security boundaries even against attackers who already have administrator-level privileges.
“While RAM misconfiguration was originally a reliability issue, this attack shows the importance of adopting and verifying safety features even when an abuse vector isn’t clear to vendors,” stated lead author Sam Collins. “In this scenario Microsoft VBS blindly trusted the shaky ground it stood on.”
The researchers also built a script that strings the attack chain together on its own, aliasing memory, rebooting and shutting off antivirus, with no further clicks or prompts from the user. That automation could make the technique easier to deploy once an attacker has already obtained the privileged access needed to carry it out.
“Windows makes a strong promise: that even an attacker with administrator rights can’t touch the secure kernel,” noted Marius Muench, assistant professor at Birmingham. “We found that promise rests on the assumption that your memory is telling the truth about itself. On a lot of the memory people buy, it doesn’t have to.”
Which memory is exposed
The team surveyed popular DDR4 and DDR5 modules and found that several vendors ship at least one product line with the configuration chip left without write protection. The researchers say this runs contrary to Joint Electron Device Engineering Council (JEDEC) guidance.
They estimate those product lines account for more than half of the high-performance consumer memory market and over 70% of the gaming segment. Other modules from other vendors use partial write protection, which was enough to block the attack.
The vulnerability lives at the memory-module level rather than with any single manufacturer. Buyers checking their own hardware should look up the write-protection status of their specific model rather than assume a brand name alone tells them whether they’re affected.
The disclosure followed a coordinated process, with affected vendors given technical details before publication. Microsoft acknowledged the research, assigned it CVE-2026-23670, and shipped mitigations in its April 2026 security updates.
According to the researchers, machines with Secure Boot enabled are protected against the attack in its current form. Machines without it remain exposed to the demonstrated technique, making Secure Boot an important baseline mitigation where supported.