A recently identified attack, termed ‘Download More RAM,’ has been found to circumvent Windows Virtualization-Based Security (VBS), compromise Hypervisor-Enforced Code Integrity (HVCI), and disable Microsoft Defender. Microsoft has acknowledged this vulnerability as CVE-2026-23670 and addressed it in their April 2026 security update.
The attack exploits vulnerabilities in the Serial Presence Detect (SPD) data on certain consumer DDR4 and DDR5 memory modules. SPD is a configuration data stored on RAM modules that informs the system about the memory’s capacity, speed, and operational parameters. If the SPD chip is writable, an attacker with local administrator privileges can manipulate this data, leading the system to misinterpret the memory’s actual capacity.
This manipulation results in memory aliasing, where two different physical addresses are perceived as separate by Windows but actually point to the same physical RAM. Typically, such a condition would destabilize the system, causing crashes. However, researchers discovered that by adjusting Windows boot configurations to reserve the aliased memory portion, the operating system remains stable, while the attacker retains access to the same physical RAM through alternate addresses.
This technique is particularly concerning as it breaches the security boundaries that VBS is designed to enforce. VBS utilizes Hyper-V to isolate critical services, including the Secure Kernel and code-integrity components, from the standard Windows kernel. The ‘Download More RAM’ attack operates directly on physical memory, effectively bypassing protections based on page tables, process permissions, and virtual trust levels.
In demonstrations, attackers were able to read aliased memory using modified forensic memory acquisition tools and write data to specific memory regions using RAM-disk utilities. Although this write method can be unstable and may corrupt data, it was sufficient to patch the Secure Kernel Code Integrity library (skci.dll), thereby disabling checks that block known vulnerable drivers. Once the blocklist was disabled, attackers could load drivers that Windows security controls had previously blocked, granting them extensive access to physical memory.
The attack chain comprises six stages:
- Memory Aliasing: Modifying SPD data to create overlapping memory addresses.
- System Stabilization: Preventing Windows from utilizing the aliased memory range.
- Memory Reading: Using a signed driver to access hidden memory.
- Memory Writing: Employing a RAM disk to modify aliased memory.
- Code Integrity Bypass: Patching skci.dll to bypass driver blocklists.
- Driver-Based Attacks: Loading previously blocked drivers to access physical memory.
This method allows for the modification of protected memory, including areas associated with VBS-protected processes and endpoint security products. In proof-of-concept tests, researchers successfully disabled Microsoft Defender’s antivirus and threat protection features. They also evaluated the impact on other security solutions, including Sophos Intercept X, Riot Vanguard, Easy Anti-Cheat, and BattlEye.
It’s important to note that this technique requires local administrator rights and a system equipped with DIMMs whose SPD configuration is writable. Researchers examined consumer memory modules and identified affected products from manufacturers such as Corsair, G.Skill, and ADATA. However, they cautioned that their testing was not exhaustive, and protection status may vary between product lines and individual models. DIMMs with protected SPD configuration blocks are not susceptible to this software-only aliasing method.
Microsoft’s April mitigation prevents the Secure Boot-compatible remove memory configuration from being exploited to stabilize aliased Windows systems, effectively blocking the demonstrated attack chain. However, this does not eliminate the broader risk posed by potential alternative stabilization techniques that may emerge.
Organizations are advised to apply current security updates promptly and assess the security configurations of their hardware components to mitigate potential risks associated with this vulnerability.
