Memory controller vulnerabilities allow bypass of hardware security

Researchers have identified critical vulnerabilities in computer memory architecture that allow attackers to bypass hardware and software security boundaries. One method, dubbed the “Download More RAM” attack, exploits unprotected configuration chips on certain DIMMs. By rewriting information reported to the system, software can trick Windows into believing the computer has more RAM than it actually does. This creates memory aliases that allow attackers to read or modify protected data without physical access.

This attack has been demonstrated against memory products from Corsair, G. Skill, and ADATA. It can be used to re-enable vulnerable drivers, compromise corporate systems, and evade kernel-level anti-cheat protections. Microsoft has addressed this issue via CVE-2026-23670, providing mitigations in April 2026 security updates. Administrators are advised to ensure Secure Boot is enabled and to install the latest cumulative updates for Windows 10 and 11.

A separate research project, “skitter-creek-bath-salts” by Christopher Domas, details a DRAM scrambling attack. This technique manipulates the memory controller’s address-translation logic to rewrite how physical addresses map to DRAM cells. By altering this mapping, an attacker can point a different address to a physical memory cell that was previously fenced off. This bypasses hardware protections such as SEV, SGX, TDX, and TrustZone, as these mechanisms rely on physical addresses remaining fixed and predictable.