Windows 11’s strongest security defenses can be bypassed without a screwdriver
Researchers found a script-only attack, 'Download More RAM', that rewrites DIMM configuration chips to bypass Windows 11 VBS and HVCI security boundaries.
Researchers at the University of Birmingham and Durham University showed that overwriting configuration data on unprotected DDR4/DDR5 module chips creates memory aliases that let attackers with existing privileged access defeat Virtualisation-based Security and HVCI, re-enable blocklisted drivers, kill EDR, and bypass group policy. Microsoft assigned CVE-2026-23670 and shipped mitigations in its April 2026 updates; systems with Secure Boot enabled are protected. Affected unprotected product lines are estimated at more than half of the high-performance consumer memory market and over 70% of the gaming segment.
- Rewriting unprotected DIMM configuration chips creates memory aliases that defeat Windows security boundaries without physical access
- Attack can re-enable blocklisted vulnerable drivers, kill EDR, extract VBS enclave data, and bypass group policy
- Requires prior privileged access; Secure Boot blocks the attack in its current form
- Affected lines cover >50% of high-performance consumer memory and >70% of gaming memory
- Microsoft assigned CVE-2026-23670 and shipped mitigations in April 2026 updates
- CVEs
- CVE-2026-23670
- Vendors
- Microsoft
- Products
- Windows 11VBSHVCI
- Organizations
- University of BirminghamDurham University
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-23670 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally | 5.7 | <1% |
From the original article
3 min read at helpnetsecurity.com
Researchers from the University of Birmingham and Durham University have found a way to knock down some of the toughest protections in Windows 11 without physically opening or modifying the target machine. The attack assumes the attacker has already gained privileged access to the system.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.