Researchers from the University of Birmingham and Durham University have published an attack, dubbed “Download More RAM,” that bypasses several of Windows 11’s strongest security defenses by exploiting the unprotected configuration chips built into ordinary RAM modules. By rewriting the data those chips report about the memory module itself, an attacker who already holds administrator privileges can create memory aliases that let malicious code disable antivirus software, circumvent Virtualization-Based Security protections, and re-enable drivers Microsoft has blocklisted as vulnerable. Microsoft assigned the flaw CVE-2026-23670 and shipped mitigations in its April 2026 security updates; the National Vulnerability Database lists it as a medium-severity, CVSS 5.7 issue that requires local, high-privilege access to exploit.
That “requires admin privileges already” qualifier is doing a lot of work in the CVSS score, and it is also exactly why the finding matters more than a 5.7 rating suggests. An attacker does not need remote code execution to reach this bypass, they need what every successful intrusion of the past several weeks on this beat has already delivered: a foothold with elevated access. Once an attacker has admin rights on a Windows endpoint, whether through credential theft, an unpatched local privilege escalation, or the kind of unauthorized administrative account creation seen in other recent exploitation campaigns, disabling the antivirus and VBS protections that are supposed to catch what happens next becomes a hardware-level trick rather than a software one, and much harder for defenders to detect after the fact.
Security leaders should not read this as a reason to panic about RAM modules. It is a reason to stop treating “attacker already has admin” as an acceptable stopping point for a threat model. Endpoint defenses that assume their own tamper-protection is unbreakable once privilege escalation occurs, the same assumption underlying perimeter devices patched under compressed timelines elsewhere this month, need compensating controls: privileged access management that limits who and what can reach local admin, and detection tuned to catch defense-tampering behavior rather than relying solely on the defenses being tampered with.
