Download More RAM Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing

A new attack dubbed “Download More RAM” can bypass Windows Virtualization-Based Security (VBS), weaken Hypervisor-Enforced Code Integrity (HVCI), and disable Microsoft Defender. Microsoft tracked the issue as CVE-2026-23670 and released mitigations in its April 2026 security update.

The attack abuses improperly protected Serial Presence Detect (SPD) data on certain consumer DDR4 and DDR5 memory modules. SPD is configuration data stored on a RAM module that specifies the system’s capacity, speed, and operating parameters.

If the SPD chip is writable, an attacker with local administrator privileges can alter the reported memory geometry, causing the system to believe a RAM module has more capacity than it physically contains.

This creates memory aliasing. Two different physical addresses are treated as separate locations by Windows but point to the same underlying RAM. Normally, such a condition would destabilize Windows and trigger blue-screen crashes.

RAM Attack Bypasses Windows VBS

The researchers found that Windows boot configuration settings could reserve the aliased portion of memory, allowing the operating system to remain stable while leaving the attacker access to the same physical RAM through alternate addresses.

The technique is significant because it crosses security boundaries that VBS is designed to enforce. VBS relies on Hyper-V to isolate sensitive services, including the Secure Kernel and code-integrity components, from the normal Windows kernel.

The Download More RAM attack instead operates against raw physical memory, bypassing protections based on page tables, process permissions, and virtual trust levels.

Researchers demonstrated that attackers could read aliased memory using a modified forensic memory acquisition tool and then use a RAM-disk utility to write limited amounts of data to selected memory regions.

Although this write method is unstable and can corrupt data, it was sufficient to patch the Secure Kernel Code Integrity library (skci.dll). The patches disabled checks used to block known vulnerable drivers.

Once the vulnerable-driver blocklist was disabled, the attack could load drivers that Windows security controls had previously blocked.

These drivers can provide broad physical memory access, turning the initially limited write capability into a more reliable read-and-write primitive.

The attack chain has six stages:

Stage	Attack Technique	Description
Stage 1	Memory Aliasing	Alters SPD data to create overlapping memory addresses.
Stage 2	System Stabilization	Prevents Windows from using the aliased memory range.
Stage 3	Memory Reading	Uses a signed driver to access hidden memory.
Stage 4	Memory Writing	Uses a RAM disk to modify aliased memory.
Stage 5	Code Integrity Bypass	Patches skci.dll to bypass driver blocklists.
Stage 6	Driver-Based Attacks	Loads blocked drivers to access physical memory.

According to the research, this enables modification of protected memory, including areas associated with VBS-protected processes and endpoint security products.

In a proof of concept, the researchers used the chain to turn off Microsoft Defender’s antivirus and threat protection. They also tested the impact on Sophos Intercept X, Riot Vanguard, Easy Anti-Cheat, and BattlEye.

The paper stresses that the technique requires local administrator rights and a system containing DIMMs whose SPD configuration remains writable.

The researchers examined consumer memory modules and found affected product lines from Corsair, G.Skill, and ADATA. They cautioned that their testing was not exhaustive and that protection status can differ between product lines and individual models.

DIMMs with protected SPD configuration blocks are not susceptible to the software-only aliasing method described in the paper. Microsoft’s April mitigation prevents the Secure Boot-compatible remove memory configuration from being used as the researchers did to stabilize aliased Windows systems.

According to the USENIX paper note, this blocks the demonstrated attack chain but does not eliminate the broader risk posed by alternative stabilization techniques that may emerge.

Organizations should apply current Windows updates, maintain Secure Boot and VBS protections, and review BIOS settings for options that prohibit SPD writes.

Memory manufacturers can reduce exposure by enforcing SPD write protection, especially for configuration blocks that define module capacity and addressing.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.