New RAM Exploit Bypasses Windows Security Barriers

A recently uncovered cyberattack, termed ‘Download More RAM,’ effectively circumvents Windows Virtualization-Based Security (VBS), undermines Hypervisor-Enforced Code Integrity (HVCI), and deactivates Microsoft Defender. Microsoft has identified this threat as CVE-2026-23670 and has provided patches in its April 2026 security update.

Vulnerability in RAM Modules

This exploit targets inadequately protected Serial Presence Detect (SPD) data on specific DDR4 and DDR5 memory modules. SPD data contains key configurations like the system’s memory capacity and speed, crucial for RAM module operations.

If the SPD chip is writable, attackers with local admin access can manipulate the reported memory structure, misleading the system into recognizing more RAM capacity than is physically present. This manipulation leads to memory aliasing, where two distinct physical addresses map to the same RAM segment, potentially causing system instability and crashes.

Impact on Windows Security Mechanisms

Researchers discovered that modifying Windows boot settings allows the system to reserve the aliased memory, maintaining stability while granting attackers access to the physical RAM through different addresses. This tactic breaches the security boundaries meant to be upheld by VBS, which uses Hyper-V for isolating sensitive components such as the Secure Kernel.

The ‘Download More RAM’ exploit operates directly on physical memory, bypassing existing protections based on virtual trust levels and process permissions. The approach allows attackers to read and write in memory regions that are supposed to be secure.

Multi-Stage Attack Process

The attack proceeds through a six-stage chain, starting with memory aliasing to create overlapping memory addresses. Subsequent stages involve stabilizing the system to prevent crashes, using signed drivers to access concealed memory, and modifying memory via a RAM-disk utility.

Further, the exploit patches the Secure Kernel Code Integrity library (skci.dll) to disable driver blocklists, enabling the loading of previously blocked drivers. These drivers can then provide extensive physical memory access, enhancing the attacker’s capabilities.

The research indicates that this method allows for the alteration of protected memory areas linked to VBS-protected processes, ultimately deactivating security products like Microsoft Defender.

Mitigation and Future Concerns

The researchers emphasize that this attack requires local administrator rights and writable SPD configurations, found in some consumer memory lines from brands like Corsair and G.Skill. However, not all products are affected, and the protection status varies.

Microsoft’s recent mitigation blocks the specific attack chain but does not address the potential for new stabilization techniques. Organizations are advised to apply the latest Windows updates, maintain Secure Boot and VBS protections, and inspect BIOS settings to prevent SPD writes.

Memory manufacturers are encouraged to implement SPD write protection, especially for critical configuration blocks, to minimize exposure to such exploits in the future.