Attackers Bypass Windows Security Without Physical Access: New “Download More RAM” Flaw Exposes a Blind Spot in Windows 11’s Strongest Defenses
For years, Microsoft has marketed Windows 11 as the most secure version of Windows ever built, leaning heavily on hardware-backed protections like virtualization-based security and hypervisor-protected code integrity to convince enterprises and consumers alike that the operating system’s core was effectively untouchable without physical access to the machine. New research presented at the 2026 USENIX Security Symposium has quietly dismantled that assumption, revealing that an attacker with no physical proximity to a target computer can bypass some of Windows’ most trusted defenses using nothing more than a script.
The research, conducted by academics from the University of Birmingham and Durham University, centers on an attack the team named “Download More RAM.” According to the university’s own announcement, the findings show that Windows makes a strong promise that even an attacker with administrator rights cannot touch the operating system’s secure kernel, and that promise depends entirely on the assumption that a computer’s memory is honestly reporting information about itself, an assumption that doesn’t hold true for a significant portion of memory people actually buy. The work earned a Distinguished Paper Award at the symposium, one of the highest honors in academic cybersecurity research, and was presented in Baltimore on August 13.
The technical root of the problem lies in an overlooked component sitting on most desktop and laptop memory modules. Every Dual In-line Memory Module, or DIMM, the physical RAM stick installed in a computer, contains a small configuration chip that tells the system how much memory capacity is available and how it’s organized. Researchers found that on many consumer-grade DDR4 and DDR5 modules, this configuration chip has no write protection at all, meaning software running on the machine can rewrite it directly. As explained by cybersecurity outlet Help Net Security, an attacker who overwrites the chip’s stored information can trick the machine into believing it has significantly more memory installed than it actually does.
That deception is where things get dangerous. Once the system believes it has more memory than it physically contains, the extra address space that gets exposed doesn’t correspond to new, empty memory. Instead, according to the original TechXplore report on the findings, those additional addresses become aliases pointing back to memory that’s already in use, effectively creating a backdoor into protected memory regions that bypasses every access control the operating system and processor have put in place. In practice, this means an attacker can potentially read or manipulate memory regions that Windows’ security architecture was specifically designed to keep isolated, including areas protected by Virtualization-Based Security and Hypervisor-Protected Code Integrity, two of the flagship defenses Microsoft has pushed as reasons to require modern hardware for Windows 11.
What sets this attack apart from previous memory-based exploits is how it’s delivered. Earlier attacks targeting similar weaknesses, including a related technique known as BadRAM, generally required an attacker to physically open a machine and interact with its hardware directly. This new research eliminates that requirement entirely. Professor Tom Chothia from the University of Birmingham noted, as reported by TechSpot, that the attack only requires a script capable of being deployed remotely, whereas earlier attacks of this kind demanded physical access to the target machine. Other reporting on the disclosure indicates the attack chain assumes the attacker has already achieved some privileged access to the system, whether through malware, a malicious document, or another initial foothold, at which point the memory aliasing technique can be used to escalate that access into control over regions Windows was supposed to keep locked down.
The scope of affected hardware is notably broad. Research findings indicate that the vulnerable configuration chip issue extends across a large share of the consumer memory market. Professor Chothia’s team identified that several major memory manufacturers, including Corsair, G.Skill, and ADATA, ship at least one product line with an unprotected configuration chip, a practice that violates guidelines set by JEDEC, the industry body responsible for memory standards. Separate reporting citing the research team’s estimates suggests more than half of high-performance consumer memory modules and roughly seventy percent of gaming-focused memory products carry this exposure, making it far from a niche or theoretical concern for anyone running a modern gaming PC or performance-oriented workstation.
To their credit, the researchers followed responsible disclosure practices before going public. The University of Birmingham confirmed that all affected vendors were notified with complete technical details well ahead of the symposium presentation. Microsoft has acknowledged the findings and assigned the vulnerability tracking number CVE-2026-23670, and the company issued mitigations as part of its April 2026 security updates. According to TechXplore’s coverage, those mitigations are effective specifically when Secure Boot is enabled on the affected machine, with additional protection available through hardware write blocking or BIOS-level configuration. Corsair has also responded directly at the hardware level, adding a feature to its iCUE software suite that lets users manually enable write protection on their memory modules, and the popular diagnostic utility HWiNFO has rolled out similar functionality for users running memory from other manufacturers.
For everyday users and IT administrators alike, the practical takeaway is straightforward even if the underlying vulnerability is technically intricate. Anyone concerned about exposure should confirm that Secure Boot is active on their system, check whether their memory manufacturer has issued a firmware or software-based write protection option, and ensure Windows systems are fully updated with the April 2026 patches or later. Enterprises managing large fleets of Windows machines, particularly those relying on hardware-based security guarantees for compliance purposes, may want to audit which memory modules are deployed across their infrastructure, given how widespread the affected chip designs appear to be.
This disclosure lands at an interesting moment for Microsoft, which has spent years positioning hardware requirements like TPM 2.0 as central to Windows 11’s security pitch. Research like this doesn’t undermine the value of those requirements outright, but it does illustrate a broader truth about modern computer security: trust assumptions baked deep into hardware supply chains can quietly undercut even the most carefully engineered software protections. Techchora has covered similar hardware-adjacent security research in the past, and this latest finding reinforces a pattern worth watching closely as attackers and defenders increasingly shift their focus below the operating system layer, toward the physical components most users never think to question.
