Key Takeaways
- The “Download More RAM” attack exploits unprotected configuration chips on DDR4/DDR5 memory modules to falsely report additional memory.
- By rewriting the chip, attackers create memory aliases that let them bypass Windows isolation mechanisms, including VBS, HVCI, kernel‑level anti‑cheat, and enterprise policy controls.
- The technique requires only privileged (administrator) access and a script—no physical tampering or reboot is needed after the initial privilege escalation.
- Affected modules lack write‑protection on the SPD (Serial Presence Detect) chip; they represent >50 % of the high‑performance consumer market and >70 % of gaming‑segment memory.
- Mitigations include enabling Secure Boot, applying Microsoft’s April 2026 patches, and verifying write‑protection status of specific memory models before purchase.
Attack Overview and Core Idea
Researchers from the University of Birmingham and Durham University introduced a novel software‑only method called “Download More RAM” that subverts Windows 11’s strongest security guarantees. The attack targets the small configuration chip embedded on Dual In‑line Memory Modules (DIMMs)—the RAM sticks found in virtually all desktops and laptops. This chip stores the module’s Serial Presence Detect (SPD) data, such as capacity, timing, and voltage settings. On many consumer modules, the chip lacks write protection, allowing any software with sufficient privileges to overwrite its contents. By feeding the system false SPD information, the operating system is tricked into believing that more physical memory exists than is actually present.
How Memory Aliasing Works
When the SPD data is altered, Windows allocates address space for the purported extra memory. Because no additional physical RAM backs those addresses, the CPU maps them to existing memory regions—creating aliases. These aliases let an attacker read from or write to memory locations that the OS intends to keep isolated, such as kernel structures, VBS enclaves, or hypervisor‑protected code. Essentially, the attacker gains a backdoor into any part of the system that shares the same physical address space, sidestepping the memory‑based isolation that Windows and the processor normally enforce.
Security Bypasses Demonstrated
Using the fabricated memory aliases, the research team showed they could accomplish several high‑impact actions:
- Reactivate hundreds of blocklisted drivers known to contain vulnerabilities, including those previously tied to malware and ransomware.
- Terminate antivirus and endpoint detection and response (EDR) agents, disabling real‑time monitoring and alerting.
- Extract data from Virtualisation‑based Security (VBS) enclaves and Hypervisor‑Enforced Code Integrity (HVCI) regions, which are designed to remain isolated even from administrators.
- Circumvent corporate device‑management policies, such as Group‑Plex restrictions enforced on managed enterprise or university machines.
- Evade kernel‑level anti‑cheat systems in games, allowing cheat software to operate undetected.
Each of these outcomes relies on the fundamental premise that Windows trusts the memory module’s self‑reported specifications; once that trust is broken, the OS’s strongest guarantees crumble.
Automation and Deployment
To illustrate the practicality of the attack, the researchers crafted a fully automated script that performs the entire chain: it rewrites the SPD chip, triggers a reboot (or uses a hot‑reload mechanism if supported), disables security software, and establishes the malicious aliases—all without further user interaction. Once an attacker has obtained privileged access (e.g., via a phishing‑derived credential theft or an existing exploit), the script can be executed remotely, making the technique scalable and suitable for large‑scale campaigns.
Root Cause: Missing Write Protection on SPD Chips
A survey of popular DDR4 and DDR5 modules revealed that numerous vendors ship at least one product line where the SPD chip lacks any write‑protection mechanism. This deviates from the Joint Electron Device Engineering Council (JEDEC) guideline, which recommends that the SPD area be read‑only after manufacturing to prevent exactly this type of manipulation. The vulnerable lines constitute more than half of the high‑performance consumer memory market and over 70 % of the gaming‑segment market. Other manufacturers employ partial write protection (e.g., protecting only certain fields), which was sufficient to block the attack in the researchers’ tests. Consequently, risk is tied to the specific module model rather than the brand alone; users must consult the SPD write‑protection status of their exact part number.
Disclosure, Mitigation, and Current Status
The findings were disclosed through a coordinated vulnerability process. Affected vendors received technical details prior to public release. Microsoft acknowledged the research, assigned it CVE‑2026‑23670, and issued mitigations in its April 2026 security updates. A key baseline defense is enabling Secure Boot: machines with Secure Boot active are protected against the current incarnation of the attack because the firmware validates the SPD data before handing control to the OS. Systems lacking Secure Boot remain exposed to the demonstrated technique, underscoring the importance of this firmware feature as a minimal security hygiene measure.
Implications for Users and Administrators
For end‑users, the takeaway is simple: verify whether your RAM modules support SPD write protection before purchasing, especially if you build high‑performance or gaming rigs. For enterprise administrators, the findings reinforce the need to enforce Secure Boot across all managed devices and to maintain an inventory of memory models to spot‑check for vulnerability. Additionally, monitoring for anomalous SPD re‑writes—though currently uncommon in endpoint telemetry—could become a valuable detection vector.
Conclusion
The “Download More RAM” attack demonstrates that hardware‑level trust assumptions, long considered immutable, can be subverted through software alone when manufacturers omit basic write‑protection safeguards. By falsifying memory capacity, attackers turn the very abstraction that enables modern OS memory management into a conduit for bypassing Windows’ most robust defenses. The remedy lies not only in patching the OS but also in pushing hardware vendors to adopt JEDEC‑compliant write protection on SPD chips and encouraging users and IT teams to validate Secure Boot and memory‑module specifications as part of their security baseline.