Researchers defeat strongest defences in Windows 11 using software alone – previous attacks like this needed a screwdriver and physical access to the machine.
Experts have shown that the most powerful security defences in Windows 11 can be dismantled by an attacker who never touches the target computer.
Presenting their findings at the 2026 USENIX Security Symposium, in Baltimore, researchers from the University of Birmingham and Durham University reveal a major flaw in the trust assumptions underpinning modern Windows security.
Their award-winning research shows that some consumer memory modules let an attacker bypass security protections Windows relies on, with no physical access to the machine. The attack, named ‘Download More RAM’, exploits the fact that many Dual In-line Memory Modules (DIMM) have no write protection on the configuration chip telling the computer how much memory is installed.
Our work exploits the fact that all processes share the same memory to bypass Windows' strongest security guarantees. Previous attacks of this kind needed a screwdriver and physical access to the machine. This one just needs a script. That changes who can carry it out and how far it can spread.
By rewriting that configuration from software, an attacker can make the machine ‘see’ twice as much memory as it really has. This reveals extra addresses that become aliases for the real ones - creating a backdoor into memory that bypasses every access control the operating system and processor put in place.
Professor Tom Chothia, from the University of Birmingham, said: "Our work exploits the fact that all processes share the same memory to bypass Windows' strongest security guarantees. Previous attacks of this kind needed a screwdriver and physical access to the machine. This one just needs a script. That changes who can carry it out and how far it can spread."
By creating ‘memory aliases’, the researchers successfully demonstrated that an attacker can:
While RAM misconfiguration was originally a reliability issue, this attack shows the importance of adopting and verifying safety features even when an abuse vector isn't clear to vendors. In this scenario Microsoft VBS blindly trusted the shaky ground it stood on.
The team also built a one-click script to carry out a whole chain of attack actions - aliasing memory, rebooting, and disabling antivirus - with no user interaction at all, showing the attack is suitable for automated, large-scale campaigns.
Professor Chothia added: “This is a new attack vector that Microsoft seems to have completely overlooked - allowing attackers to bypass the strongest defence that Windows has to offer.”
Lead author Sam Collins, from the University of Birmingham, said: “While RAM misconfiguration was originally a reliability issue, this attack shows the importance of adopting and verifying safety features even when an abuse vector isn't clear to vendors. In this scenario Microsoft VBS blindly trusted the shaky ground it stood on.”
The researchers surveyed popular consumer DDR4 and DDR5 memory modules and found that three manufacturers - Corsair, G.Skill and ADATA - ship at least one product line with the configuration chip left entirely unprotected, contrary to Joint Electron Device Engineering Council (JEDEC) guidance.
Together, these vendors account for 55% of the high-performance consumer memory market and over 70% of the gaming segment. Modules from Crucial, Kingston and HyperX, and some G.Skill lines, were found to use partial write protection, which is sufficient to block the attack.
Windows makes a strong promise: that even an attacker with administrator rights can't touch the secure kernel. We found that promise rests on the assumption that your memory is telling the truth about itself - on a lot of the memory people actually buy, it doesn't have to.
Researchers were able to read and modify any memory on the system, including memory that Windows guarantees is off-limits even to the operating system itself. This breaks not only VBS, but also Hypervisor Enforced Code Integrity (HVCI) - the technologies Microsoft designed to protect Windows even against attackers with administrator rights.
Dr Marius Muench, from the University of Birmingham, said: “The ‘Download More RAM’ attack demonstrates once more the importance of understanding systems, especially in terms of security guarantees. If a lower layer can become compromised, it puts the full system at risk.
“Windows makes a strong promise: that even an attacker with administrator rights can't touch the secure kernel. We found that promise rests on the assumption that your memory is telling the truth about itself - on a lot of the memory people actually buy, it doesn't have to."
The work follows coordinated disclosure practice: all affected vendors were notified with full technical details well ahead of publication.
Microsoft acknowledged the team’s findings, assigned CVE-2026-23670, and issued mitigations in its April 2026 security updates. Windows machines running with SecureBoot enabled are protected against the attack in its current form. Machines without SecureBoot remain vulnerable, and the research team advises users to ensure that SecureBoot is enabled.
Corsair has added a feature to its iCue tooling that lets owners retroactively enable write protection on their memory modules, closing the hole at the hardware level. The free tool HWinfo has also adopted this functionality, providing mitigation for non-Corsair models. Some motherboards offer a BIOS setting to block writes to memory configuration chips, which users can enable as an interim measure.
For more information, please contact the University of Birmingham press office or +44 (0)7827 832312
'Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory’ - Sam Collins, Tom Chothia, William Burgess and Marius Muench (University of Birmingham) and David Oswald (University of Durham) is published on Open Access.
The University of Birmingham is ranked amongst the world’s top 100 institutions. Its work brings people from across the world to Birmingham, including researchers, teachers and more than 40,000 students from over 150 countries.
England’s first civic university, the University of Birmingham is proud to be rooted in one of the most dynamic and diverse cities in the country. A member of the Russell Group and a founding member of the Universitas 21 global network of research universities, the University of Birmingham has been changing the way the world works for more than a century.
The research received a Distinguished Paper Award at the USENIX Security Symposium and was presented on 13 August 2026. Research artefacts, including a video of the end-to-end attack, are available.
Professor of Cyber Security
Staff profile for Dr Tom Chothia for the School of Computer Science
Assistant Professor
Dr Marius Muench is an Assistant Professor at University of Birmingham. His main research area is computer security with a special focus on embedded systems, fuzzing, binary analysis, and mobile network security.
