CVE-2026-23670 is a vulnerability that allows an attacker with local administrator privileges to bypass Windows Virtualization-Based Security (VBS), weaken Hypervisor-Enforced Code Integrity (HVCI), and disable Microsoft Defender. The attack exploits improperly protected Serial Presence Detect (SPD) data on certain consumer DDR4 and DDR5 memory modules, causing memory aliasing by altering the reported memory geometry, which can destabilize Windows and trigger blue-screen crashes. Reserving the aliased portion of memory in Windows boot configuration settings allows the operating system to remain stable while leaving the attacker access to the same physical RAM through alternate addresses. The Download More RAM attack operates against raw physical memory, bypassing protections based on page tables, process permissions, and virtual trust levels. Attackers can read aliased memory using a modified forensic memory acquisition tool and write limited amounts of data to selected memory regions via a RAM-disk utility. Once the vulnerable-driver blocklist is disabled, the attack can load drivers that Windows security controls had previously blocked, providing broad physical memory access. This enables modification of protected memory, including areas associated with VBS-protected processes and endpoint security products. The researchers demonstrated the attack chain on several systems, disabling Microsoft Defender’s antivirus and threat protection. They also tested the impact on other security products, stressing that the technique requires local administrator rights and a system containing DIMMs whose SPD configuration remains writable. Organizations should apply current Windows updates, maintain Secure Boot and VBS protections, and review BIOS settings for options that prohibit SPD writes.
We recommend you to refer this link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23670[/subscribe_to_unlock_form]
CVE-2026-23670 is a vulnerability that allows an attacker with local administrator privileges to bypass Windows Virtualization-Based Security (VBS), weaken Hypervisor-Enforced Code Integrity (HVCI), and disable Microsoft Defender. The attack exploits improperly protected Serial Presence Detect (SPD) data on certain consumer DDR4 and DDR5 memory modules, causing memory aliasing by altering the reported memory geometry, which can destabilize Windows and trigger blue-screen crashes. Reserving the aliased portion of memory in Windows boot configuration settings allows the operating system to remain stable while leaving the attacker access to the same physical RAM through alternate addresses. The Download More RAM attack operates against raw physical memory, bypassing protections based on page tables, process permissions, and virtual trust levels. Attackers can read aliased memory using a modified forensic memory acquisition tool and write limited amounts of data to selected memory regions via a RAM-disk utility. Once the vulnerable-driver blocklist is disabled, the attack can load drivers that Windows security controls had previously blocked, providing broad physical memory access. This enables modification of protected memory, including areas associated with VBS-protected processes and endpoint security products. The researchers demonstrated the attack chain on several systems, disabling Microsoft Defender’s antivirus and threat protection. They also tested the impact on other security products, stressing that the technique requires local administrator rights and a system containing DIMMs whose SPD configuration remains writable. Organizations should apply current Windows updates, maintain Secure Boot and VBS protections, and review BIOS settings for options that prohibit SPD writes.
We recommend you to refer this link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23670[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]