Researchers from the University of Birmingham and Durham University have disclosed a serious hardware-based attack that could allow attackers to bypass key Windows 11 security protections without physically accessing the targeted computer. The researchers presented their findings at the 2026 USENIX Security Symposium, showing how weaknesses in the configuration memory of certain consumer RAM modules can be abused to undermine security mechanisms relied upon by Windows.
The technique, dubbed “Download More RAM,” exploits inadequate write protection on a configuration chip found in some DIMMs, or Dual In-line Memory Modules. This chip stores information that tells a computer how much memory is installed. On affected modules, the configuration can potentially be modified through software because the chip is not sufficiently protected against unauthorized writes.
Altering RAM Configuration Creates Memory Aliases
According to the researchers, modifying the configuration can make a system believe that it has significantly more memory than it physically contains. This can expose additional memory addresses that act as aliases for genuine memory locations.
Through these memory aliases, an attacker may gain access to memory that should normally remain protected by operating system and processor-level security controls.
The researchers demonstrated that the technique could be used to re-enable hundreds of known-vulnerable drivers that had previously been blocked because of their use in malware and ransomware campaigns.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
Antivirus and EDR Protections Could Also Be Undermined
The research also demonstrated that memory aliasing can potentially be used to disable antivirus and Endpoint Detection and Response (EDR) software. These security tools continuously monitor systems for suspicious activity and help detect or block cyberattacks.
The researchers further showed that the technique could compromise protections associated with Microsoft’s Virtualization-based Security (VBS), including access to memory enclaves designed to isolate sensitive information.
The attack can also undermine Hypervisor-Enforced Code Integrity (HVCI), a security technology intended to protect Windows against threats even when an attacker has administrator-level privileges.
One-Click Attack Chain Demonstrated
The research team reportedly developed a one-click script capable of automating several stages of the attack, including memory aliasing, rebooting the system and disabling antivirus protections. According to the researchers, the process does not require user interaction, raising concerns about the possibility of automated and large-scale exploitation.
The researchers surveyed popular consumer DDR4 and DDR5 memory modules and found that at least one product line from Corsair, G.Skill and ADATA had configuration chips without complete write protection.
The study estimated that these three manufacturers collectively account for about 55% of the high-performance consumer memory market and more than 70% of the gaming segment.
By contrast, modules from Crucial, Kingston and HyperX, along with some G.Skill product lines, were found to use partial write protection that was sufficient to prevent the demonstrated attack.
Microsoft Assigned CVE-2026-23670
The researchers followed coordinated disclosure procedures and informed affected vendors before making their findings public. Microsoft acknowledged the vulnerability, assigned it CVE-2026-23670 and released mitigations through its April 2026 security updates.
Windows systems with Secure Boot enabled are currently protected against the demonstrated form of the attack. Systems running without Secure Boot, however, may remain vulnerable.
The researchers have therefore advised users and organizations to verify that Secure Boot is enabled and to apply the relevant Microsoft security updates.
Memory Vendors Also Introduce Mitigations
Corsair has added functionality to its iCUE software that allows users to enable write protection on compatible memory modules after installation, providing a hardware-level mitigation.
The HWiNFO utility has also incorporated similar functionality for compatible modules from other manufacturers. In addition, some motherboard manufacturers provide BIOS settings that can block write operations to memory configuration chips, offering another mitigation option.
A University of Birmingham researcher warned that strong operating system security ultimately depends on the integrity of lower-level system components. If an attacker can compromise a lower layer, protections implemented above it may also be put at risk.
The findings highlight that protecting Windows systems requires more than software updates and antivirus tools alone. Organizations using potentially affected hardware should verify Secure Boot status, install Microsoft’s security updates and enable hardware-level write protection where supported.
