USENIX — Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory

www.usenix.org • August 16, 2026

Sam Collins, Tom Chothia, William Burgess, and Marius Muench, The University of Birmingham; David Oswald, Durham University

Distinguished Paper Award Winner

Virtualisation-Based Security (VBS) is the cornerstone of modern Windows desktop defences, relied upon by both the operating system and third-party software, with a virtualised secure kernel providing strong security guarantees against even privileged attackers. In this paper, we introduce Download More RAM, software-only memory aliasing attack that breaks these guarantees without physical access. On systems running the most common consumer DIMMs, our attack allows arbitrary memory read/write, letting a privileged user compromise the OS at every level, including the secure kernel, Hypervisor Enforced Code Integrity (HVCI), and all defences it provides. With this access we develop a series of case study attacks targeting VBS-protected processes, Windows Defender, anti-virus & EDR software, and game anti-cheats. Our work breaks the strongest security guarantees offered by the Windows OS, questioning key trust assumptions on such systems. Microsoft have assigned CVE-2026-23670 to our findings and issued a patch that partially mitigates our attack.

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Download More RAM Attack Bypasses Windows 11 Security Defenses Researchers have identified a new attack, termed 'Download More RAM', that allows attackers to bypass Windows 11's Virtualization-Based Security (VBS) and disable Microsoft Defender without physical access to the target machine. This attack exploits vulnerabilities in certain consumer DDR4 and DDR5 memory modules, specifically targeting the unprotected Serial Presence Detect (SPD) data. The attack enables arbitrary memory read/write operations, compromising the operating system and its security features. Microsoft has acknowledged the issue as CVE-2026-23670 and released a partial mitigation in April 2026. The research was presented at the 2026 USENIX Security Symposium, highlighting a significant flaw in trust assumptions surrounding Windows security. The attack can be executed using a simple script, making it suitable for automated, large-scale exploitation. Major manufacturers like Corsair, G.Skill, and ADATA have been identified as having vulnerable products, affecting a significant portion of the high-performance memory market. 6 sources 73

Extracted Entities

USENIX — Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)