Reported by 2 outlets
Download More RAM Attack Bypasses Windows VBS, HVCI and Disables Microsoft Defender
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 2.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Download More RAM Attack Bypasses Windows VBS, HVCI and Disables Microsoft Defender
gbhackers.com · 59d ago · August 15th, 2026
A newly disclosed Windows attack technique, dubbed “Download More RAM,” can undermine Virtualization-Based Security (VBS), bypass Hypervisor-Protected Code Integrity (HVCI), and disable endpoint protections including Microsoft Defender and third-party EDR products. The attack was presented at USENIX Security 2026 and is tracked by Microsoft as CVE-2026-23670. Unlike a conventional Windows kernel exploit, Download More RAM […] The post Download More RAM Attack Bypasses Windows VBS, HVCI and Disables Microsoft Defender appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
“Download More RAM” Attack Breaks Windows VBS and Disables EDR Protections
cyberpress.org · 59d ago · August 15th, 2026
Documented by USENIX, the attack does not exploit a conventional Windows kernel vulnerability. Instead, it targets an overlooked weakness in certain consumer DDR4 and DDR5 memory modules: writable Serial Presence Detect (SPD) configuration data. SPD data tells a system’s firmware how much memory is installed and how it is organized. If the SPD EEPROM is insufficiently write-protected, an attacker with local administrator privileges can alter the reported geometry of a DIMM, causing the system to believe that more RAM is present than is physically present. New “Download More RAM” Attack Breaks Windows VBS That incorrect configuration causes memory aliasing: different physical addresses map to the same underlying DRAM locations. The researchers call the technique “Download More RAM” because the machine effectively reports double the capacity of an affected memory stick, even though no additional physical RAM is installed. Windows Virtual Trust Levels Visualised (source: usenix) Unlike earlier BadRAM-style research, the demonstrated attack is software-only and does not require attackers to remove, modify, or reinstall memory modules. The impact is severe because aliased memory can expose the raw physical memory space that