Three New Windows Attacks Target Memory, Defender, and Driver Security

Windows users have faced a fresh wave of security research targeting parts of the operating system that normally help keep PCs safe.

Three separate attacks have drawn attention in recent weeks. They target system memory, Microsoft Defender and Windows’ automatic driver installation process.

The findings do not mean every Windows PC can be hacked remotely. Each attack has its own limits and requirements.

Still, the research raises an important concern. Security tools can become attack paths when Windows trusts the wrong hardware setting, driver, or system process.

“Download More RAM” Attacks Windows Memory Protections

The most unusual of the three is “Download More RAM.” Researchers from the University of Birmingham and Durham University presented the work at USENIX Security 2026. Their research shows that an attacker can create fake memory addresses by changing data stored on certain RAM modules.

RAM modules contain a small configuration chip called Serial Presence Detect, or SPD. It tells the computer important details about the memory. The researchers found that e some DDR4 and DDR5 modules allow someone to change this data without enough protection.

By altering it, an attacker can make Windows believe the computer has more memory than it really does. Windows may then map those extra addresses onto memory already in use. That creates two addresses for the same physical memory.

The researchers used this memory aliasing to bypass protections that normally separate sensitive parts of Windows. Their tests showed access to areas protected by Virtualization-Based Security and Hypervisor-Enforced Code Integrity.

The impact could be serious. The researchers demonstrated attacks against Microsoft Defender, antivirus, and endpoint tools. They also showed ways to target game anti-cheat software and protected Windows processes.

NIST tracks this flaw as CVE-2026-23670. They say it’s a local flaw requiring high privileges and no initial remote access.

That distinction matters. An attacker won’t be able to scan the Internet to use this vulnerability to compromise a Windows computer. They first need code running on the machine and elevated access.

They had already rolled out a broader fix in their April 2026 security update. Also, if you have Secure Boot turned on, you’re safer. It blocks the kind of memory configuration that this attack relies on.

ShieldBreak Targets Defender

The second issue involves Microsoft Defender. This comes after RoguePlanet, a Windows Defender privilege vulnerability which Nightmare Eclipse disclosed in June.

RoguePlanet (that’s CVE-2026-50656) goes after Microsoft’s Malware Protection Engine, and it lets someone with almost no privileges obtain SYSTEM-level access. Microsoft patched this back in July by updating Malware Protection Engine to version 1.1.26060.3008.

ShieldBreak later surfaced as a way around that earlier fix. However, no patch was available for ShieldBreak as of the time of writing. One shouldn’t confuse it with the current status of RoguePlanet itself. Microsoft has patched CVE-2026-50656.

Recent reporting also suggests that newer Windows Defender updates might already be able to detect or block ShieldBreak on some systems. Tom’s Hardware reported that testing on a recent Windows 11 build showed Defender detecting the exploit.

The race between attackers and defenders extends to commercial malware. The Steaelite RAT includes a module for Windows Defender disabling and exclusion management, allowing operators to disable endpoint security after initial compromise.

So users should not treat claims that Defender is simply “unprotected” as a settled fact. The safest move remains the same: keep Windows and Defender fully updated.

“Plug and Pwn” Turns Driver Installation into an Attack Path

The third finding comes from security researchers Borja Martinez and Alejandro Hernando. Their DEF CON 34 research, called “Plug And Pwn: Weaponizing Windows PnP Auto-Install,” examines Windows Plug and Play.

Windows normally makes hardware setup easy. When it detects a device, it can find and install a matching driver. The researchers found that this process can create a dangerous path to SYSTEM-level code execution.

They built tools that could imitate USB devices. They found that this same method kicks in with USB redirection over Remote Desktop Protocol, if the conditions are right. So, an attacker doesn’t always have to walk up and plug something into a computer; remote access might do the trick.

The team also dug through thousands of driver packages and spotted WHQL-signed software that’s vulnerable to this attack route. This does not mean signed drivers are automatically malicious. The problem is that a trusted installation process may load a driver containing its own exploitable weakness.

The research therefore highlights a less obvious Windows security risk: automatic driver installation itself can become part of an attack chain.

What Windows Users Should Do Now

For most users, the first step is simple. Install the latest Windows updates and allow Microsoft Defender to update normally. This is especially important because CVE-2026-23670 and RoguePlanet already have Microsoft fixes.

Secure Boot should also remain enabled where supported. It provides an important defense against the “Download More RAM” technique. Businesses face a broader challenge. They should review automatic driver installation rules and limit which devices can install drivers.

Organizations using RDP should also review USB redirection settings. Restricting unnecessary device access can reduce exposure to the Plug and Pwn research. The bigger lesson is not that Windows has suddenly become unsafe.

It is that modern attacks increasingly target the trust built into Windows itself. Memory settings, security scanners and automatic driver installation all exist to make computers safer and easier to use.

Researchers are now showing how those same features can become security weaknesses when attackers find a way to control the process.