This post is also available in:
עברית (Hebrew)
Windows 11 uses hardware-backed security to isolate sensitive information even from software with administrator privileges. But those protections depend on the hardware beneath them behaving as expected. New research shows that on some computers, attackers can exploit an overlooked feature of the RAM itself to undermine that trust, without ever physically touching the machine.
Researchers from the University of Birmingham and Durham University demonstrated an attack called “Download More RAM”, which targets configuration chips found on some DDR4 and DDR5 memory modules.
These chips store information describing the installed memory. On certain consumer DIMMs, that configuration remains writable from software. An attacker who has already gained sufficient software access can modify it so the computer incorrectly believes it has twice as much physical memory as is actually installed.
According to TechXplore, the nonexistent additional memory creates what researchers call memory aliases. Addresses that appear to point toward extra RAM instead map back onto real physical memory. Accessing protected information through these alternative addresses can bypass restrictions enforced through the normal memory map.
In testing, the researchers used this technique to reach memory that Windows intends to isolate even from highly privileged software. That allowed them to defeat Virtualization-based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI), which use virtualization to separate sensitive parts of the operating system from the ordinary Windows environment.
The team demonstrated several consequences, including disabling antivirus and Endpoint Detection and Response software, accessing secrets inside VBS-protected environments and re-enabling hundreds of vulnerable drivers normally blocked by Windows. They also bypassed enterprise device-management restrictions and kernel-level anti-cheat protections.
More concerningly, the researchers created a one-click attack chain that could configure the memory alias, reboot the machine and disable antivirus without subsequent user interaction.
A survey of consumer memory found at least some product lines from Corsair, G.Skill and ADATA with unprotected configuration chips. Modules from Crucial, Kingston and HyperX, along with some G.Skill products, used partial write protection sufficient to prevent the demonstrated attack.
The vulnerability has clear implications for government, defense and enterprise computers because VBS is intended to preserve security even after an attacker gains administrator-level privileges. The research demonstrates how protections at the operating-system level can fail when they rely on incorrect assumptions about lower-level hardware.
Microsoft assigned the issue CVE-2026-23670 and released mitigations in its April 2026 security updates. According to the researchers, Windows systems with Secure Boot enabled are protected against the attack in its demonstrated form, while machines without it remain vulnerable.
Hardware-level mitigations are also becoming available. Corsair added an option to enable RAM configuration write protection through its iCUE software, while HWiNFO provides similar functionality for other compatible modules. Some motherboards can also block configuration-chip writes through BIOS settings.
The finding highlights an important cybersecurity principle: even sophisticated software isolation is only as trustworthy as the hardware assumptions underneath it.
