Back Feeds.4Sysops

“Download More RAM” attack bypasses Windows 11 defenses without physical access

Feeds.4Sysops •IT News • August 13, 2026

Researchers have demonstrated that the “Download More RAM” attack can turn software-only access into a way around Windows 11 security controls—without physically modifying the target PC. The technique abuses writable configuration data on some DDR4 and DDR5 modules to create fake memory addresses, potentially disabling antivirus and EDR tools and bypassing VBS and HVCI. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Download More RAM Attack Bypasses Windows 11 Security Defenses Researchers have identified a new attack, termed 'Download More RAM', that allows attackers to bypass Windows 11's Virtualization-Based Security (VBS) and disable Microsoft Defender without physical access to the target machine. This attack exploits vulnerabilities in certain consumer DDR4 and DDR5 memory modules, specifically targeting the unprotected Serial Presence Detect (SPD) data. The attack enables arbitrary memory read/write operations, compromising the operating system and its security features. Microsoft has acknowledged the issue as CVE-2026-23670 and released a partial mitigation in April 2026. The research was presented at the 2026 USENIX Security Symposium, highlighting a significant flaw in trust assumptions surrounding Windows security. The attack can be executed using a simple script, making it suitable for automated, large-scale exploitation. Major manufacturers like Corsair, G.Skill, and ADATA have been identified as having vulnerable products, affecting a significant portion of the high-performance memory market. 6 sources 73

Extracted Entities

Platforms (1)

Windows 11