Researchers from the University of Birmingham and Durham University have identified a software-based method to bypass significant security protections in Windows 11, even when an attacker already possesses privileged access to a system. The technique, dubbed "Download More RAM," targets a configuration chip on Dual In-line Memory Modules (DIMMs), commonly known as RAM sticks, found in most desktop and laptop computers.
The attack exploits the fact that on numerous consumer memory modules, this configuration chip, which stores details like memory capacity, lacks write protection. This allows an attacker with privileged access to rewrite critical parts of the chip's information. By manipulating this data, a machine can be tricked into believing it has more memory than physically present. These "extra" memory addresses do not correspond to new physical RAM but instead alias, or point to, existing memory regions already in use. This aliasing enables access that circumvents the isolation mechanisms normally enforced by Windows and the processor.
According to the researchers, this method allows an attacker to access parts of the system that Windows is designed to keep isolated, including memory reserved for the operating system itself. Specifically, the team demonstrated several capabilities once memory aliasing is established. These include re-enabling hundreds of blocklisted drivers with known vulnerabilities, some previously associated with malware and ransomware. The attack can also disable antivirus and endpoint detection and response (EDR) software, which are crucial for monitoring and flagging malicious activity.
Furthermore, the technique can extract data from Virtualization-based Security (VBS) enclaves, which are designed to keep information isolated from the rest of the machine. It can also bypass corporate device management rules, such as group policy restrictions common in enterprise and university environments, and circumvent kernel-level anti-cheat protections in games. The researchers noted that the attack impacts VBS and Hypervisor-Enforced Code Integrity (HVCI), two protections Microsoft implemented to maintain security boundaries even against adversaries with administrator-level privileges.
The research highlights that Microsoft's security promises, particularly regarding the secure kernel's integrity even with administrator access, rely on the assumption that memory modules accurately report their configuration. The team developed an automated script that can chain together the attack, performing memory aliasing, rebooting the system, and disabling antivirus software without further user interaction, potentially simplifying its deployment for attackers who have already gained privileged access.
A survey of popular DDR4 and DDR5 memory modules revealed that several vendors ship product lines with the configuration chip lacking write protection, which the researchers state goes against Joint Electron Device Engineering Council (JEDEC) guidance. They estimate these vulnerable product lines constitute over half of the high-performance consumer memory market and more than 70% of the gaming segment. Other modules from different vendors incorporate partial write protection, which was sufficient to block the attack. The vulnerability resides at the memory-module level, not with a single manufacturer. Users are advised to check the write-protection status of their specific memory module model rather than relying solely on brand names.
Microsoft has acknowledged the research, assigning it CVE-2026-23670, and released mitigations in its April 2026 security updates. The researchers confirmed that systems with Secure Boot enabled are protected against the attack in its current form. However, machines without Secure Boot remain exposed to the demonstrated technique, making Secure Boot an important baseline mitigation where supported.
