Search

Download More RAM Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing

A new attack dubbed “Download More RAM” can bypass Windows Virtualization-Based Security (VBS), weaken Hypervisor-Enforced Code Integrity (HVCI), and disable Microsoft Defender. Microsoft tracked the issue as CVE-2026-23670 and released mitigations in its April 2026 security update. The attack abuses improperly protected Serial Presence Detect (SPD) data on certain consumer DDR4 and DDR5 memory modules. SPD is configuration data stored on a RAM module that specifies the system’s capacity, speed, and operating parameters. If the SPD chip is writable, an attacker with local administrator privileges can alter the reported memory geometry, causing the system to believe a RAM module has more capacity than it physically contains. This creates memory aliasing. Two different physical addresses are treated as separate locations by Windows but point to the same underlying RAM.