Three new Windows flaws can bypass security, gain system privileges, and even install malware remotely

What we know so far: Cybersecurity researchers have uncovered at least three new vulnerabilities that could potentially allow attackers to gain system privileges even on patched Windows computers. These include a memory configuration chip exploit named “Download more RAM,” a zero-day flaw dubbed “ShieldBreak,” and a “plug and pwn” exploit that could install malware remotely over RDP.

The “Download More RAM” vulnerability, which was presented at the 2026 USENIX Security Symposium in Baltimore, was discovered by researchers from the University of Birmingham and Durham University. It reportedly allows malicious actors to bypass Windows 11 security and gain system privileges without physical access by exploiting the lack of write protection on consumer memory modules.

The vulnerability allows anybody to remotely rewrite the Serial Presence Detect configuration chip that notifies the computer about the amount of installed RAM in the system. Attackers can take advantage of this vulnerability to transmit fake information to the computer, tricking it into believing that it has twice as much RAM installed as it actually does.

The false data tricks the memory controller into mapping additional pseudo-addresses, which overlap with genuine addresses. The aliases allow attackers to create a backdoor into memory by circumventing security and access control mechanisms used by the operating system and the processor.

The vulnerability could potentially allow hackers to re-enable old drivers with known exploits, disable anti-malware software, break into virtualization-based security enclaves, change corporate device management settings, and even bypass kernel-level anti-cheat systems used by video games.

Professor Tom Chothia from the University of Birmingham noted that the attack only requires a script that can be deployed remotely, while previous attacks of this kind required physical access to the machine. He added that major memory brands, including Corsair, G.Skill, and ADATA, ship at least one model line with an unprotected configuration chip in violation of JEDEC guidelines.

Tracked as CVE-2026-23670, the vulnerability has been acknowledged by both Microsoft and Corsair. While Microsoft issued mitigations in its April 2026 update, Corsair has added a feature to its iCue hardware management tool, allowing users to enable write protection on their DIMMs. PC diagnostic app HWiNFO has also added the same feature for non-Corsair users.

There’s also a zero-day vulnerability called ShieldBreak, found by bug hunter Nightmare Eclipse. Tracked as CVE-2026-50656, it’s an elevation-of-privilege vulnerability in Microsoft Defender that can circumvent the RoguePlanet patch and allow attackers to gain system privileges on Windows 10, Windows 11, and Windows Server. However, Microsoft Defender has to be active for the exploit to work.

Finally, security researchers Alejandro Hernando and Borja Martinez have described a new “plug and pwn” attack that exploits Windows’ automatic hardware identification and driver installation process to install signed vendor driver packages with system-level privileges.

Presented at DEF CON 34 in Las Vegas, the vulnerability can be exploited without admin privileges and without a logged-in user. In their proof-of-concept demo, the researchers also showed that the attack can be performed remotely over RDP without connecting any physical USB hardware to the target device.