Critical Windows Vulnerability Bypasses VBS, Disables Defender

Key Takeaways

• A novel attack, dubbed “Download More RAM,” can bypass Windows Virtualization-Based Security (VBS) and disable Microsoft Defender.
• The vulnerability, tracked as CVE-2026-23670, exploits improperly protected Serial Presence Detect (SPD) data on certain consumer DDR4 and DDR5 memory modules.
• An attacker requires local administrator privileges and a system with writable SPD chips on its memory modules.
• Microsoft issued mitigations for this flaw in its April 2026 security updates.
• Affected memory module lines include products from Corsair, G.Skill, and ADATA, though the issue may be more widespread.

“Download More RAM” Attack Exploits Memory Flaw to Bypass Windows Security

A sophisticated new attack, dubbed “Download More RAM,” has been uncovered, demonstrating the ability to circumvent Windows Virtualization-Based Security (VBS), weaken Hypervisor-Enforced Code Integrity (HVCI), and ultimately disable Microsoft Defender. This critical vulnerability, identified by Microsoft as CVE-2026-23670, received official mitigations in the company’s April 2026 security update release.

The core of the attack leverages a weakness in how certain consumer DDR4 and DDR5 memory modules handle Serial Presence Detect (SPD) data. SPD refers to crucial configuration information stored directly on a RAM module, detailing its capacity, speed, and operational parameters for the system. When this SPD chip lacks proper write protection, an attacker with local administrator privileges can manipulate the reported memory geometry. This manipulation tricks the operating system into believing a RAM module possesses greater capacity than its physical reality, leading to a condition known as memory aliasing.

Memory aliasing occurs when two distinct physical addresses are perceived by Windows as separate locations but, in reality, point to the very same underlying physical RAM. Ordinarily, such a discrepancy would cause severe instability in Windows, frequently resulting in blue-screen crashes.

Bypassing VBS with Memory Aliasing

Researchers discovered a critical method to stabilize the system despite memory aliasing: by carefully configuring Windows boot settings to reserve the aliased portion of memory. This prevents the operating system from directly using the “phantom” memory, allowing Windows to remain stable while an attacker retains access to the shared physical RAM through the alternate, aliased addresses.

This technique marks a significant breakthrough as it successfully crosses security boundaries that VBS is specifically engineered to protect. VBS utilizes Hyper-V technology to isolate vital system services, such as the Secure Kernel and code-integrity components, from the standard Windows kernel. However, the “Download More RAM” attack operates at the level of raw physical memory, effectively sidestepping protections based on page tables, process permissions, and virtual trust levels.

The researchers demonstrated their findings by using a modified forensic memory acquisition tool to read the aliased memory. Subsequently, a RAM-disk utility enabled them to write limited amounts of data to specific memory regions. While this writing method proved unstable and could lead to data corruption, it was sufficient to patch the Secure Kernel Code Integrity library (skci.dll). This crucial patch disabled checks designed to block known vulnerable drivers, opening the door for further compromise.

With the vulnerable-driver blocklist neutralized, the attack could then load drivers that Windows security controls had previously blocked. These compromised drivers provided extensive physical memory access, transforming the initial, limited write capability into a far more reliable read-and-write primitive.

The Six-Stage Attack Chain

The “Download More RAM” attack unfolds in a meticulously orchestrated six-stage process:

• Stage 1: Memory Aliasing – Alters SPD data to create overlapping memory addresses.
• Stage 2: System Stabilization – Configures Windows to prevent it from using the aliased memory range.
• Stage 3: Memory Reading – Utilizes a signed driver to access the hidden, aliased memory.
• Stage 4: Memory Writing – Employs a RAM disk utility to modify data within the aliased memory.
• Stage 5: Code Integrity Bypass – Patches skci.dll to bypass driver blocklists.
• Stage 6: Driver-Based Attacks – Loads previously blocked drivers to gain full physical memory access.

This complete chain enables the modification of protected memory areas, including those associated with VBS-protected processes and endpoint security products. As a proof of concept, the researchers successfully used this method to disable Microsoft Defender’s antivirus and threat protection features. They also tested its impact on other security products, including Sophos Intercept X, Riot Vanguard, Easy Anti-Cheat, and BattlEye.

According to the USENIX paper note, the technique necessitates local administrator rights and a system equipped with DIMMs whose SPD configuration blocks remain writable. The researchers identified affected consumer memory module lines from Corsair, G.Skill, and ADATA during their examination, cautioning that their testing was not exhaustive and that protection status can vary significantly between product lines and even individual models.

DIMMs featuring protected SPD configuration blocks are not vulnerable to the software-only aliasing method detailed in the research. Microsoft’s April mitigation specifically addresses this by preventing the Secure Boot-compatible remove memory configuration from being exploited to stabilize aliased Windows systems, as demonstrated by the researchers. While this blocks the currently demonstrated attack chain, the paper stresses that it does not eliminate the broader risk posed by potential alternative stabilization techniques that may emerge in the future.

What You Should Do

• Apply Windows Updates: Ensure all systems are updated with Microsoft’s April 2026 security patches to mitigate CVE-2026-23670.
• Maintain Secure Boot and VBS: Verify that Secure Boot and Virtualization-Based Security (VBS) protections are enabled and configured correctly on all endpoints.
• Review BIOS Settings: Check BIOS/UEFI settings for options that prohibit SPD writes on memory modules. If available, enable these protections.
• Consult Memory Manufacturers: Organizations should encourage memory manufacturers to enforce SPD write protection, particularly for configuration blocks defining module capacity and addressing, to reduce exposure to similar vulnerabilities.
• Implement Least Privilege: Reinforce the principle of least privilege, as this attack requires local administrator rights.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.