Download More RAM Attack Bypasses Windows Security via Memory Aliasing
A novel attack named 'Download More RAM' exploits DDR4/DDR5 RAM SPD data to create memory aliasing, bypassing Windows VBS and disabling security software like Microsoft Defender.
A sophisticated attack, dubbed "Download More RAM," has been detailed by researchers, capable of bypassing crucial Windows security features like Virtualization-Based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI), and even disabling Microsoft Defender. Tracked by Microsoft as CVE-2026-23670, the vulnerability leverages improperly protected Serial Presence Detect (SPD) data found on certain consumer DDR4 and DDR5 memory modules. SPD chips contain configuration data for RAM modules, dictating parameters such as capacity and speed. When this data is writable, an attacker with local administrator privileges can manipulate it to report a larger memory capacity than physically present, a technique known as memory aliasing.
Memory aliasing occurs when two distinct physical memory addresses are mapped by the system to the same underlying RAM location. While such a condition would typically lead to system instability and crashes, the researchers discovered a method to stabilize Windows by reserving the aliased memory range. This stabilization allows the operating system to function normally while leaving the attacker with access to the same physical RAM through alternate addresses. This technique is particularly significant as it operates at the level of raw physical memory, circumventing security boundaries enforced by VBS, which relies on the Hyper-V hypervisor to isolate sensitive components like the Secure Kernel and code integrity services from the main operating system kernel.
The attack chain involves several stages. Initially, SPD data is altered to create the memory aliasing. Subsequently, Windows is stabilized to prevent crashes. The attacker then uses a signed driver to read the hidden, aliased memory. A RAM-disk utility is employed to write limited data to the aliased regions, which, although potentially unstable, is sufficient to patch the Secure Kernel Code Integrity library (skci.dll). This patching bypasses the checks that prevent known vulnerable drivers from loading.
Once the driver blocklist is disabled, the attack can proceed to load drivers that would normally be blocked by Windows security controls. These drivers grant extensive physical memory access, transforming the initial limited write capability into a more robust read-and-write primitive. This allows for modification of protected memory regions, including those associated with VBS-protected processes and endpoint security solutions.
In a proof-of-concept demonstration, the researchers successfully used this attack chain to disable Microsoft Defender's antivirus and threat protection capabilities. The attack was also tested against other security products, including Sophos Intercept X, Riot Vanguard, Easy Anti-Cheat, and BattlEye, with concerning results. The researchers noted that the exploit requires local administrator privileges and a system with DIMMs that have writable SPD configurations.
While the researchers identified affected product lines from Corsair, G.Skill, and ADATA, they cautioned that their testing was not exhaustive, and susceptibility can vary between different models and product lines. DIMMs with protected SPD configurations are immune to this specific software-only aliasing method. Microsoft's April mitigation addresses the use of specific memory configuration methods for stabilization, effectively blocking the demonstrated attack chain. However, the researchers warn that the broader risk from alternative stabilization techniques remains.
To mitigate this threat, organizations are advised to apply the latest Windows updates, ensure Secure Boot and VBS protections are enabled, and review BIOS settings for options that might permit SPD writes. Memory manufacturers are encouraged to enforce SPD write protection, particularly for configuration blocks that define memory capacity and addressing, to reduce exposure.