Download More RAM Attack Defeats Windows VBS
Security researchers recently discovered an extraordinarily novel method to circumvent some of the most heavily fortified components within Windows 11. They execute this bypass directly through standard physical memory manipulation. They appropriately named this technique the Download More RAM attack. This sophisticated exploit forces the host computer to genuinely believe it possesses double its actual installed physical memory. Subsequently, the attacker leverages these newly generated “phantom” addresses to infiltrate isolated memory regions. These critical areas must remain completely inaccessible, even to the local system administrator. Consequently, the researchers successfully bypassed Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI). Ultimately, they interfered directly with the secure Windows kernel and disabled critical security mechanisms.
At a glance: Exploiting the SPD Chip
Experts hailing from the Universities of Birmingham and Durham developed this ingenious technique. They formally presented their groundbreaking findings at the prestigious USENIX Security 2026 conference. Microsoft subsequently assigned this vulnerability the identifier CVE-2026-23670. Unlike numerous traditional physical memory attacks, this method does not require opening the computer chassis, physically extracting RAM modules, or utilizing an external hardware programmer to flash firmware. The researchers executed the entire attack chain using purely software-based tools.
The Mechanics of Memory Aliasing
The foundation of this method relies on a small Serial Presence Detect (SPD) microchip installed directly on the memory module. The SPD continuously stores vital information regarding the DIMM’s characteristics, including its total capacity, precise memory organization, operating frequencies, and various other parameters. Crucially, certain consumer-grade memory modules permit software to overwrite critical SPD regions directly from the operating system. This vulnerability exists simply because the hardware manufacturer failed to implement comprehensive write-protection protocols.
After acquiring local administrative rights, the researchers intentionally altered the SPD configuration. They modified it so the module falsely reported double its true memory capacity to the host computer. For instance, a physical 8 GB module effectively transformed into 16 GB from the system’s perspective. Naturally, this new memory did not spontaneously materialize. Instead, the upper half of the newly expanded address space began pointing directly to the exact same physical DRAM cells as the lower half. Computer scientists technically refer to this specific effect as memory aliasing.
Shattering Virtualization-Based Security Boundaries
For the Windows operating system, these two distinct groups of addresses appeared as entirely separate sections of RAM. However, they physically accessed identical memory cells. By expertly exploiting this induced confusion, an attacker could access protected memory contents through the alternative, aliased address. This cleverly bypassed strict restrictions enforced by the operating system, the processor, and the hypervisor. The researchers successfully transformed this mechanism into a fully functional attack chain, granting them arbitrary read and write access to physical memory.
Disabling Kernel Protections
The ability of the Download More RAM attack to violently breach the VBS boundary makes this problem exceptionally severe. VBS utilizes Hyper-V technology to isolate critically important Windows components within a separate, highly secure environment. This environment remains strictly inaccessible to the standard operating system kernel. Theoretically, even a malicious program possessing full administrative privileges cannot freely modify the memory of the secure kernel. However, this attack fundamentally shatters that assumption, granting direct access to isolated regions via physical memory manipulation.
During their demonstration, the researchers maliciously altered the skci.dll component. This specific component is responsible for verifying code integrity within the secure kernel. Furthermore, they successfully disabled the strict verification of Microsoft’s blocklist for vulnerable drivers. Following this severe interference, Windows resumed permitting the loading of cryptographically signed but notoriously vulnerable drivers. Through these compromised drivers, the attacker gained stable, arbitrary access to physical memory, effectively destroying the protective boundaries established by VBS and HVCI.
Real-World Implications and Mitigation Strategies
The authors successfully demonstrated several practical attack scenarios. By leveraging the Download More RAM attack, they interfered with processes protected by the strict Protected Process Light (PPL) mechanism. They also successfully disabled Microsoft Defender, compromised Sophos Intercept X, and altered executing code located deep within secure VBS environments. Furthermore, the researchers demonstrated devastating attacks against robust video game anti-cheat systems. They successfully assembled the complete chain into an automated script. Once the script acquires the necessary initial privileges, it executes almost entirely without further user interaction.
Hardware Vulnerabilities and Partial Fixes
During their comprehensive verification process, the specialists discovered completely writable SPD regions on specific modules manufactured by Corsair, G.Skill, and ADATA. However, the study did not comprehensively cover every manufacturer’s entire product line. Therefore, discovering a vulnerable model from one brand does not automatically imply that the problem affects the company’s entire memory portfolio. Certain tested modules from G.Skill, Crucial, HyperX, and Kingston possessed at least partial SPD protection. This partial protection proved sufficient to successfully block the specific attack variant described in the study.
Crucially, one cannot consider this attack a universal method to remotely hack any Windows computer. To initiate the attack sequence, the malicious actor already requires local administrative privileges. Furthermore, the installed memory hardware must explicitly allow the modification of specific SPD regions. This scenario primarily demonstrates a chilling reality: administrative rights on modern Windows machines do not guarantee absolute control over secure components. However, a specific hardware quirk in RAM allows an attacker to overcome the final security boundary.
Microsoft received advanced notification regarding the attack methodology and released defensive modifications on April 14, 2026. On computers utilizing Secure Boot, the company actively blocked the removememory boot mechanism. The researchers had previously utilized this mechanism to stabilize Windows following the creation of the memory aliases. In the publicly detailed variant of the attack, this specific defensive step successfully breaks the exploit chain. However, if a user disables Secure Boot, the technique remains fully operational. The authors themselves characterize this software fix as merely partial because the fundamental problem concerning the writable SPD remains deeply embedded within the hardware itself.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
