A novel attack exploits writable RAM metadata to breach Windows Virtualisation-Based Security, highlighting hardware trust issues and posing new challenges for defence strategies amid increased malware obfuscation tactics.
Researchers have shown that a Windows security chain designed to keep even administrator-level attackers away from protected memory can be broken without opening the case. According to the University of Birmingham and USENIX Security materials, the attack works by altering the Serial Presence Detect data on consumer RAM modules, which lets a system believe it has more memory than is physically installed and creates an alias into memory the operating system assumed was isolated. That, in turn, gives the attacker arbitrary read and write access inside areas guarded by Windows Virtualisation-Based Security.
The work, titled “Download More RAM: Dismantling Windows Operating System Defences with Mischievous Memory”, was presented at the USENIX Security Symposium by Sam Collins, Tom Chothia, William Burgess, Marius Muench and David Oswald. The researchers said the chain can be driven from software alone, with no physical modification to the machine, and can then be used to tamper with components that check drivers, disable Defender and other security tools, and interfere with game anti-cheat systems.
The vulnerability is tracked as CVE-2026-23670. The National Vulnerability Database lists it as a Windows Virtualisation-Based Security enclave security feature bypass, with a CVSS score of 5.7 and a Medium severity rating. Microsoft’s own classification marks it Important, but the public records also note that the exploit requires local administrative privileges, which is why the score reflects high attack complexity and high privileges required. The researchers’ April 2026 patch discussion centres on Secure Boot-compatible memory reservation as the practical mitigation for the specific chain they demonstrated.
The broader significance is that the attack does not rely on a kernel bug in the usual sense. Instead, it abuses memory metadata that many consumer modules leave writable. The academic paper says the problem affects some widely sold DDR4 and DDR5 products, while other lines ship with partial protection that blocks the change. That makes the weakness a hardware trust issue as much as a software one, because Windows can enforce only what the platform firmware and memory module allow it to read.
The timing also matters because the research lands alongside a separate criminal market built on evading detection. Insikt Group, Recorded Future’s research arm, has documented subscription-based crypting services that repackage malware so antivirus products see something different on disk. Those sellers advertise rapid re-crypting, broad claims of bypassing Microsoft Defender and other endpoint tools, and prices ranging from low single-file fees to several thousand dollars for premium access. Together, the two stories point to the same defensive pressure: static scanning and signature checks are increasingly insufficient, while behavioural monitoring and platform hardening have become more important.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
