“Download More RAM” is the name of a real security attack, not a way to add memory with software. Researchers showed that an attacker who already has local administrator privileges can exploit certain RAM modules whose configuration data is not adequately write-protected, potentially undermining Windows protections without physically handling the target computer. It does not make every Windows PC vulnerable, and it is not an unauthenticated internet attack.
What “Download More RAM” actually means
The name refers to a security research paper by Sam Collins, Tom Chothia, William Burgess, Marius Muench, and David Oswald. The paper was presented at the 35th USENIX Security Symposium in Baltimore in August 2026 and received a Distinguished Paper Award. It studies how memory-module configuration data can be abused to undermine protections that Windows expects to keep sensitive memory isolated.
As an Amazon Associate I earn from qualifying purchases.
RAM cannot be added by downloading a program: a computer needs physical memory modules. In this attack, software changes information that a module reports about its addressable capacity. The extra reported capacity is not real extra memory; it can cause different addresses to refer to the same physical memory, creating an opportunity to reach areas the operating system intends to protect.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the memory configuration attack works
SPD data is the target
Memory modules store configuration information in a small EEPROM chip. This information is called Serial Presence Detect, or SPD, and helps the computer identify and configure the DIMM. If relevant SPD write protection is absent, an attacker with the required privileges can alter what the module reports about its capacity.
#1 Best Overall
- Boosts System Performance: 32GB DDR5 RAM laptop memory kit (2x16GB) that operates at 5600MHz, 5200MHz, or 4800MHz to improve multitasking and system responsiveness for smoother performance
- Accelerated gaming performance: Every millisecond gained in fast-paced gameplay counts—power through heavy workloads and benefit from versatile downclocking and higher frame rates
- Optimized DDR5 compatibility: Best for 12th Gen Intel Core and AMD Ryzen 7000 Series processors — Intel XMP 3.0 and AMD EXPO also supported on the same RAM module
- Trusted Micron Quality: Backed by 42 years of memory expertise, this DDR5 RAM is rigorously tested at both component and module levels, ensuring top performance and reliability
- ECC Type = Non-ECC, Form Factor = SODIMM, Pin Count = 262-Pin, PC Speed = PC5-44800, Voltage = 1.1V, Rank And Configuration = 1Rx8
Aliased addresses can undermine isolation
If the operating system is told that a DIMM has more addressable capacity than it physically contains, some memory addresses can alias: apparently separate addresses may map to the same physical memory. That creates a path to memory that Windows security features expect to be inaccessible. The researchers demonstrated a software-only route on Windows 11; the target did not have to be physically touched.
The attack is not a simple, reliable one-step change. The paper describes early boot failures with some aliased-memory configurations and instability when attempting writes through a RAM-disk approach. Its broader technical account involves stabilizing the system, reading aliased memory, obtaining a limited write capability, and extending that capability through code-integrity changes. Those details explain why the finding matters, but they do not make it a general-purpose recipe for bypassing Windows security.
Rank #2
- Boosts System Performance: 32GB DDR4 desktop memory RAM kit (2x16GB) that operates at 3200MHz, 3000MHz, or 2666MHz to improve multitasking and system responsiveness for smoother performance
- Easy Installation: Upgrade your desktop RAM with ease—no computer skills required Follow step-by-step how-to guides available at Crucial for a smooth, worry-free installation
- Compatibility Guaranteed: Ensure seamless compatibility with your desktop by using the Crucial System Scanner or Crucial Upgrade Selector—get accurate recommendations for your specific device
- Trusted Micron Quality: Backed by 42 years of memory expertise, this DDR4 RAM is rigorously tested at both component and module levels, ensuring top performance and reliability
- ECC Type = Non-ECC, Form Factor = UDIMM, Pin Count = 288-pin, PC Speed = PC4-25600, Voltage = 1.2V, Rank and Configuration = 1Rx8 or 2Rx8
What an attacker needs—and what the study demonstrated
Prerequisites matter
- Local administrator access: The paper’s attacker model assumes the attacker already has elevated privileges on the Windows computer. The work does not establish a way for an unauthenticated remote attacker to gain that access.
- An affected memory configuration: The DIMM must have relevant SPD write protection missing or insufficient. The findings do not apply to every module or every Windows machine.
- A software attack path: The researchers demonstrated that the attack can be carried out without physically opening or handling the target computer.
Protections the researchers reported affecting
The demonstrations covered VBS-protected processes, Windows Defender, third-party antivirus and endpoint detection and response (EDR), device management, and kernel-level game anti-cheat. The paper’s summary says the attack can reach the secure kernel and Hypervisor-protected Code Integrity (HVCI). These are reported research demonstrations, not evidence that every product or configuration in those categories can be bypassed in the same way.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How broad is the affected-memory finding?
The researchers surveyed consumer DDR4 and DDR5 DIMMs. A University of Birmingham summary identified at least one product line each from Corsair, G.Skill, and ADATA with the relevant configuration chip left unprotected. It also reported partial write protection on some Crucial, Kingston, HyperX, and G.Skill modules that was sufficient to block the attack. These are product-line findings, not blanket claims about every module made by those companies; G.Skill appears in both findings, underscoring why a brand name alone cannot establish whether an individual DIMM is affected.
Rank #3
- Boosts System Performance:16GB DDR4 laptop memory RAM kit (2x8GB) that operates at 3200MHz to improve multitasking and system responsiveness for smoother performance
- Easy Installation: Upgrade your laptop RAM with ease—no computer skills required Follow step-by-step how-to guides available at Crucial for a smooth, worry-free installation
- Compatibility Guaranteed: Ensure seamless compatibility with your laptop by using the Crucial System Scanner or Crucial Upgrade Selector—get accurate recommendations for your specific device
- Trusted Micron Quality: Backed by 42 years of memory expertise, this DDR4 RAM is rigorously tested at both component and module levels, ensuring top performance and reliability
- ECC Type = Non-ECC, Form Factor = SODIMM, Pin Count = 260-pin, PC Speed = PC4-25600, Voltage = 1.2V, Rank and Configuration = 1Rx16, 1Rx8 or 2Rx8
The researchers estimated that the named vendors together accounted for over 55% of the high-performance consumer memory market and over 70% of the gaming memory segment. Those figures describe researchers’ estimates of market segments in 2026, not the share of all computers that are vulnerable. The findings do not establish a model-by-model list of affected or protected modules.
What mitigations have been reported
The paper says Microsoft assigned CVE-2026-23670 and included a mitigation in the April 2026 security update, while characterizing the patch as partial. The University of Birmingham reported that systems with Secure Boot enabled are protected against the attack in its current form. It also reported a Corsair iCUE write-protection feature, similar functionality adopted by HWiNFO for non-Corsair models, and BIOS settings on some motherboards that block writes to configuration chips.
Rank #4
- Boosts System Performance:64GB DDR4 laptop memory RAM kit (2x32GB) that operates at 3200MHz, 2933MHz, or 2666MHz to improve multitasking and system responsiveness for smoother performance
- Easy Installation: Upgrade your laptop RAM with ease—no computer skills required Follow step-by-step how-to guides available at Crucial for a smooth, worry-free installation
- Compatibility Guaranteed: Ensure seamless compatibility with your laptop by using the Crucial System Scanner or Crucial Upgrade Selector—get accurate recommendations for your specific device
- Trusted Micron Quality: Backed by 42 years of memory expertise, this DDR4 RAM is rigorously tested at both component and module levels, ensuring top performance and reliability
- ECC Type = Non-ECC, Form Factor = SODIMM, Pin Count = 260-pin, PC Speed = PC4-25600, Voltage = 1.2V, Rank and Configuration = 2Rx8
| Mitigation route | What has been reported | What to verify |
|---|---|---|
| Windows security update | Microsoft’s April 2026 update includes a mitigation for CVE-2026-23670; the paper describes it as partial. | Check Microsoft’s current CVE and security guidance for the Windows version and build in use. |
| Secure Boot | The University of Birmingham says Windows systems with Secure Boot enabled are protected against the attack in its current form. | Confirm Secure Boot is enabled on the specific system and consult current Microsoft guidance. |
| Memory-vendor utility | The University of Birmingham reports that Corsair added an iCUE write-protection feature. | Check the manufacturer’s documentation for supported modules and software versions. |
| HWiNFO | The University of Birmingham reports that HWiNFO adopted similar functionality for non-Corsair models. | Confirm compatibility for the specific DIMM and use current utility documentation. |
| Motherboard BIOS control | Some motherboards reportedly offer BIOS settings that block writes to configuration chips. | Check the motherboard manual and firmware options; availability is not established for every board. |
These reports are not a complete current compatibility matrix. Secure Boot status, DIMM SPD write-protection support, utility compatibility, and motherboard BIOS options are separate checks; a feature available for one system or module should not be assumed to cover another. The available findings do not establish a universally recommended RAM replacement, and buying generic replacement memory is not shown to be a mitigation.
What to do if you manage a Windows PC
- Check Windows update status. Review Microsoft’s current CVE-2026-23670 and security guidance for the exact Windows version and build, rather than assuming the April 2026 mitigation fully addresses every case.
- Check Secure Boot. Verify its status using the system’s supported Windows or firmware interface, then follow current Microsoft guidance on the reported protection.
- Identify the exact memory and motherboard models. Use their manufacturers’ documentation to determine whether SPD write protection or a relevant BIOS control is supported. A company name alone does not identify the protection status of a DIMM.
- Use only compatible documented controls. If a memory utility or BIOS setting is available, confirm the exact hardware and software support before applying it. Do not treat a setting or utility documented for another model as equivalent.
Professor Tom Chothia, Professor of Cyber Security at the University of Birmingham, said: “Our work exploits the fact that all processes share the same memory to bypass Windows’ strongest security guarantees. Previous attacks of this kind needed a screwdriver and physical access to the machine. This one just needs a script. That changes who can carry it out and how far it can spread.” The essential qualification is that the paper’s model still requires local administrator access and an affected memory configuration.
Quick Recap
Best Value
![[32GB DDR3L RAM] DDR3L-1600 UDIMM 32GB Kit (4x8GB) 2Rx8 PC3L-12800U 8GB PC3-12800 DDR3-1600MHz 240 Pin DIMM Non ECC Unbuffered 1.35V/1.5V CL11 Dual Rank Desktop Memory Ram](https://m.media-amazon.com/images/I/51RufLQVpTL._SL160_.jpg)
- 32GB DDR3L 1600MHz PC3L 12800U Kit (8GBx4) UDIMM 240-Pin Non-ECC Unbuffered 2Rx8 Dual Rank Desktop Memory, With strong compatibility and high stability with motherboards of various brands.
- High-Quality and Strict Test: All Motoeagle chips are from big brand manufacturers ，a high level of reliability. All chips 100% Tested. It can provide your computer with superior memory quality and the stability required for long term system operation.
- Plug and Play: Memory upgrade is one of the fastest, easiest, and most affordable ways to immediately improve the performance of your computer. It can improve your computer system performance, reduce power consumption and extend battery life. Faster burst access speed for improved sequential data throughput, bring you great online and game experience.
- Attention: Before purchase, please ensure your computer ram model, max ram and ram slot. Before installation, please wipe connection finger gently with eraser.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
