Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory

Interesting Article you can download the PDF for more info from the link

Sam Collins, Tom Chothia, William Burgess, and Marius Muench, The University of Birmingham; David Oswald, Durham University

The new findings come from security researchers at the University of Birmingham and Durham University, who presented their findings at the 2026 USENIX Security Symposium in Baltimore this week. Dubbed “Download More RAM,” the attack exploits an overlooked weakness in how some consumer memory modules report their configuration to a computer.

The problem lies in a configuration chip on certain DDR4 and DDR5 DIMMs that tells the system how much memory is installed. On affected modules, this chip lacks write protection, allowing software to modify the information it contains. This can then make Windows believe that the system has twice as much RAM as it actually does.

That sounds relatively harmless, but the resulting extra memory addresses can act as aliases for real memory locations. Therefore, this gives an attacker a way to read and modify memory that should otherwise be protected by Windows and the processor.

It is a little ironic that this news drops at a time Microsoft is quite actively working to improve memory performance, as that has been a major complaint.

The researchers used this technique to bypass several of Windows’ security measures, including Virtualization-based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI). They also demonstrated attacks that can disable antivirus and EDR software, re-enable vulnerable drivers previously blocked because of their use in malware campaigns, compromise locked-down corporate systems, and bypass kernel-level game anti-cheat protections.

Interestingly and rather concerningly, the team also created a one-click script capable of chaining the attack together, including creating the memory aliases, rebooting the machine, and disabling antivirus without requiring further user interaction.

The researchers found that Corsair, G.Skill, and ADATA each ship at least one consumer memory product line with the configuration chip completely unprotected. These are major memory vendors, and so together, the companies are said to account for a large portion of the high-performance consumer (~55%) and gaming memory (~70%) markets.

The good news is that Microsoft was notified before the research became public and assigned the issue ID CVE-2026-23670. The Redmond giant has since issued mitigations in its April 2026 security updates. Thus, systems with Secure Boot enabled are protected against the attack in its current form.

Users are therefore advised to make sure Secure Boot is enabled and update to the latest (August 2026) Windows Patch Tuesday updates (Windows 10 / Windows 11) as they are cumulative in nature. Corsair has also added an option to its iCUE software to enable write protection on affected modules, while HWiNFO has added similar functionality for non-Corsair memory. Some motherboards additionally provide BIOS settings that can prevent writes to these configuration chips.

I thought this was going to be about DownloadMoreRAM.com - CloudRAM 3.0 | AI-Powered Memory. Interesting nonetheless.

From the USENIX paper:

Official mitigation by Microsoft was pushed as part of the April 14, 2026, Windows security update. While details of the mitigation are unavailable, we observed two main behaviour changes to the OS. First, the removememory boot parameter is no longer available on systems running Secure Boot. Unlike other parameters which are deleted, removememory is now silently ignored. Second, the suite of VBS defences, including HVCI and Credential Guard, now run on systems without secure boot enabled. Previously, secure boot was a strict requirement for VBS defences. As a result, systems without secure boot are still affected

Click to expand...

ORLY?

TLDR: There's a hardware design flaw in some models of fancy DDR4/DDR5 DIMM's. Which can be exploited by running an insecure RAMDISK program.

Normally this RAMDISK app is blocked because it runs one of those dodgy Ring0 kernel drivers your mom and MS warned you about. Since the grad students aren't smart enough to defeat the blocklist's hashing algorithm, they patch a DLL and have it report every submitted kernel driver as OK. Using the RAMDISK app as their leverage, they write misleading data to the DIMM's controller chip.

Now they can access any memory, anywhere.

The mitigation is to enable HVCI (Core Integrity), which was designed to contain dodgy kernel drivers. But MS only reserved HVCI for when Secure Boot is enabled, and now they're forced to run HVCI outside of Secure Boot mode.

You could also just not run with admin privileges.

Hey, how do uninstall this RAM? I'm afraid Windows will expand my page file to be bigger than my system disk's size.

“Download More RAM” .. suprised to see this post is not being flooded

I suspect that the corporate goal will eventually be to keep physical RAM at a minimum while keeping subscribers dependant on virtual memory. Not your virtual memory — their virtual memory, which they will provide for a nominal fee. At the end of the day it is about band width so these data servers will be dictating what can and what can't be done in collaboration with ISPs. O, brave new world here we come!

On chip photonics really is a thing >>