A joint research team from the University of Birmingham and Durham University has disclosed a novel security bypass technique targeting Windows 11 systems. The attack method, dubbed Download More RAM, allows attackers to circumvent core operating system protections purely through software, eliminating the need for physical access or specialized hardware tools.
Presented at the USENIX Security Symposium, the award-winning study demonstrates how software scripts can trick a computer into misinterpreting its installed memory configuration. By doing so, attackers can bypass hardware-enforced access controls, disable endpoint protection tools, and execute unauthorized drivers on fully updated systems.
Windows 11 Security Defenses Bypass Research
The core of the study revolves around how modern operating systems rely on hardware integrity to enforce isolation boundaries. Historically, memory-aliasing attacks required physical modification of hardware modules or physical access with special probing tools. However, this new research highlights a vulnerability where local software scripts can rewrite configuration data on consumer memory sticks.
By spoofing the physical capacity of installed RAM, the exploit creates overlapping memory aliases. These virtual memory overlays allow malicious actors to access protected system memory regions, rendering high-level Windows 11 defenses ineffective despite all standard OS updates being active.
New Academic Study on Windows 11 Security
The academic paper details how small configuration chips found on Dual In-line Memory Modules, commonly known as DIMMs, often lack robust write protection against local software execution. These chips store crucial data, such as timing parameters and memory capacity, which the motherboard reads during startup.
When an attacker with elevated administrative privileges runs a custom script, the script modifies this configuration chip in real time or for the next system boot cycle. As a result, the operating system is tricked into addressing non-existent physical locations that actually map back to sensitive kernel memory.
Professor Tom Chothia, a lead cyber security researcher at the University of Birmingham, emphasized the shift in risk profile during his presentation. He noted that previous attacks of this nature required physical access and tools like screwdrivers, whereas the newly discovered method relies solely on automated software scripts. This shift significantly lowers the barrier to entry for potential threat actors once initial system access is gained.
How the Protection Bypass Works
To execute the exploit, an attacker must first possess privileged access on the targeted system. Once established, the malicious script writes forged SPD (Serial Presence Detect) information to the memory module's configuration EEPROM. Upon rebooting or refreshing memory tables, the motherboard allocates a larger address space than physically exists.
Because the physical memory cannot expand beyond its actual capacity, the CPU host controller aliases the excess address range onto existing physical memory blocks. Operating system access controls rely on physical memory separation to shield critical kernel structures. Through memory aliasing, the attacker can write to an allowed alias address that directly alters forbidden core system files or security services.
During their tests, researchers demonstrated that this method could silently disable Windows Defender, terminate Endpoint Detection and Response agents, and force the operating system to load vulnerable, blocklisted drivers that malware routinely exploits.
Implications for Enterprise and Personal Systems
The implications of this security research extend across consumer desktops and enterprise infrastructure. While the attack requires initial administrator rights to execute the configuration overwrite, it completely breaks the security boundaries that prevent compromised administrative accounts from gaining kernel-level dominance.
In enterprise environments, security models rely on a strict separation between administrative privileges and kernel access. Features like Kernel DMA Protection, Hypervisor-Protected Code Integrity, and driver blocklists are explicitly designed to contain administrative account compromises. The ability to bypass these protections using a software script exposes a significant blind spot in hardware-level trust models.
Furthermore, consumer PCs using non-ECC DDR4 or DDR5 RAM sticks are particularly vulnerable because many consumer hardware vendors leave the SPD EEPROM chips unlocked to allow user customization and overclocking profiles.
Microsoft Security Response and Outlook
Microsoft was notified of the findings prior to the public disclosure at the USENIX conference and assigned the tracking identifier CVE-2026-23670 to the issue. In response, Microsoft released platform updates aimed at verifying memory tables and strengthening boot integrity checks.
However, security analysts point out that full mitigation requires coordination across hardware manufacturers. System builders and RAM vendors must enforce write protection on SPD chips at the factory level to prevent software from modifying hardware specifications dynamically. Microsoft has advised system administrators to ensure that Secure Boot remains active and that system firmware is updated regularly to incorporate manufacturer patches.
This breakthrough research serves as a stark reminder that software security controls are only as strong as the underlying hardware trust anchors. As hardware and software continue to integrate tightly, research into low-level component vulnerabilities will remain critical for securing next-generation computing platforms.
