Researchers Show “Download More RAM” Bypass for EAC, BattlEye, and Vanguard
Security researchers have demonstrated a new way to tamper with Windows systems by targeting SPD (Serial Presence Detect) data inside off-the-shelf DDR4 and DDR5 memory modules—an approach that can also undermine several popular PC anti-cheat systems. The attack, presented under the name “Download more RAM,” focuses on the memory configuration stored on the DIMM itself, and the team showed it could be used to interfere with Windows kernel integrity checks used by Easy Anti-Cheat, Battleye, and Riot Vanguard.
The core idea is that a modifiable RAM module can cause far more trouble than incorrect timings or a machine that simply won’t boot. In the researchers’ demonstration, the “entry point” is the SPD area on the DIMM, where basic information about the module is stored, including capacity, configuration, and parameters supported by the memory. They report that in multiple tested DDR4/DDR5 modules, write protection was missing for SPD data blocks that are normally expected to be protected.
How “Download more RAM” abuses SPD data
“Download more RAM” works by altering the configuration stored in SPD so Windows believes there is more RAM available than physically exists. That mismatch creates memory address aliases that map back onto the same real physical storage areas. From there, the researchers were able to reach memory regions that Windows is supposed to keep isolated from one another.
While the demonstration shows effects beyond just the RAM itself, the full chain of the attack requires local administrator privileges. That means it’s not a remote, no-access-needed Windows exploit. Still, the paper describes the ability to target multiple Windows security components, including Virtualization-Based Security and HVCI, as well as Windows Defender and other endpoint protection mechanisms.
Anti-cheat systems tested: EAC, Battleye, Vanguard
The team specifically tested the method against three widely used anti-cheat solutions: Easy Anti-Cheat, Battleye, and Riot Vanguard. They report that none of the three was able to stop the manipulation of Windows kernel integrity checks (or secure-kernel integrity checks). For Riot Vanguard, the researchers went further in their proof of concept by changing the running driver vgk.sys and disabling a detection hook it contained—without, according to their write-up, triggering visible detection.
Battleye’s defenses made at least part of the attack chain more difficult: the researchers’ driver was blocked. As a result, that portion of the sequence had to be executed before launching the protected game. The researchers also state that Epic Games and Riot Games were informed before publication. They add that both companies acknowledged the potential impact on their anti-cheat systems and issued bug bounties, and that at the time of the investigation no specific countermeasures were reportedly released publicly because there was no known use of the attack in the wild.
The research ties these findings to a broad set of PC titles. Easy Anti-Cheat is used in games including Fortnite and Apex Legends. Battleye is used in titles such as Destiny 2 and Rainbow Six Siege. Riot Vanguard is required for Valorant and League of Legends.
Which DDR4/DDR5 modules were exposed
From the paper’s testing of eleven DDR4 and DDR5 DIMMs, the researchers found that five had all tested SPD blocks unprotected. Those include DDR4 modules from the Corsair Vengeance line (two models), G.Skill Aegis, and Adata XPG, along with a Corsair Vengeance DDR5-5200 module. Other tested brands/models had at least partial SPD write protection.
At the same time, the team notes that partial protection can be enough to stop the published technique. Under JEDEC guidance, the first two SPD data blocks are especially important because they contain key configuration details for the DIMM. In the researchers’ view, protecting those areas is sufficient to prevent the attack method described in the paper.
They list the fully unprotected models as follows: Corsair Vengeance DDR4-2666 (“CMK32GX4M-2A2666C16”), Corsair Vengeance DDR4-3000 (“CMK32GX4M-1D3000C16”), G.Skill Aegis DDR4-3200 (“F43200C16-8GIS”), Adata XPG DDR4-3200 (“DDR4 3200 2OZ”), and Corsair Vengeance DDR5-5200 (“CMK32GX5M-2B5200C40”).
Not all kits are the same: an extra Corsair Vengeance check
The findings also highlight that even within a single marketing series, SPD protection can vary by specific configuration. A separate check examined a Corsair Vengeance DDR5-6000 module with the part number CMK32GX5M2B6000Z30. In that case, the monitoring tool HWInfo reported active write protection for SPD blocks 0 and 1, which correspond to the areas the paper says are the critical protected region for blocking the attack.
The write-up also states that the specific Corsair Vengeance DDR5 module analyzed in the paper is described as fully unprotected, meaning the results cannot be generalized to every Corsair Vengeance DDR5 kit. It also notes that since HWInfo version 8.46, users can directly view write protection status per SPD block on DDR5, and that the tool can set protection as well—though it cautions that a set protection state may be permanent. For verification, reading the existing state is presented as sufficient.
To check SPD block protection in HWInfo, the researchers’ associated instructions describe starting the tool and opening the “Memory Timings” window, selecting the desired DDR5 module, then clicking “SPD W-P” to display all sixteen SPD blocks and their write-protection status.
Updates and Secure Boot limit the released chain
On modern Windows systems, the demonstrated published variant is not necessarily fully usable anymore. Microsoft assigned the issue CVE-2026-23670 and shipped security updates dated April 14, 2026. The researchers then observed an additional behavior change: when Secure Boot is enabled, Windows ignores the specific boot parameter “removememory” that their attack chain relied on. As a result, the published “Download more RAM” variant does not work on updated systems with Secure Boot turned on.
Without Secure Boot, the researchers say the demonstrated attack chain remains usable. They describe the mitigation as partial—suggesting that if a different approach is found to keep Windows stable under the manipulated memory address conditions, the rest of the chain could regain relevance.
