New Flaws Expose Patched Windows Systems to Privilege Escalation

Security researchers Alejandro Hernando and Borja Martinez have exposed a novel “plug and pwn” attack method that takes advantage of the automatic hardware identification and driver installation mechanism in Windows to deploy signed vendor driver packages with elevated system-level privileges.

Unveiled during the DEF CON 34 conference in Las Vegas, this flaw requires neither administrator permissions nor an active logged-in user to execute. During their proof-of-concept demonstration, the researchers revealed that the compromise can even be orchestrated remotely via Remote Desktop Protocol without attaching physical USB hardware to the target computer.

This technique aligns with a broader class of software security threats known as Bring Your Own Vulnerable Driver (BYOVD) exploits, where threat actors leverage digitally signed kernel drivers to bypass Windows Driver Signature Enforcement. Because Windows trusts legitimate vendor certificates, flawed drivers allow attackers to run arbitrary code inside kernel space, bypassing standard user-mode defense layers.

Additionally, security researcher Nightmare Eclipse identified a zero-day flaw dubbed ShieldBreak. Designated as CVE-2026-50656, this elevation-of-privilege security issue resides in Microsoft Defender and bypasses the previous RoguePlanet patch, permitting adversaries to acquire system privileges across Windows 10, Windows 11, and Windows Server platforms, provided Microsoft Defender remains active on the machine.

Security enclaves and built-in protection tools like Microsoft Defender operate with high execution privileges to monitor system activity, making them prime targets for local privilege escalation attacks. The RoguePlanet mitigation previously sought to patch logic flaws in Defender’s scanning engine, but ShieldBreak demonstrates how subtle architectural edge cases in security software can be repurposed to achieve privilege escalation.

Discovered by academics from Durham University and the University of Birmingham, the “Download More RAM” security flaw was detailed at the 2026 USENIX Security Symposium in Baltimore. The vulnerability reportedly enables attackers to circumvent Windows 11 defenses and attain system-level access without physical contact, exploiting unmitigated write protections on off-the-shelf consumer memory sticks.

The defect permits malicious actors to remotely alter the Serial Presence Detect configuration chip, which instructs the motherboard and operating system on total installed system memory. Exploiting this weakness allows attackers to feed fabricated hardware telemetry to the machine, deceiving the system into registering double its actual physical memory capacity.

This spoofed telemetry compels the onboard memory controller to map supplemental pseudo-addresses that overlap directly with legitimate memory addresses. These memory aliases provide bad actors with a covert channel into system RAM, effectively bypassing access controls and security parameters maintained by both the operating system and CPU architecture.

Serial Presence Detect EEPROM chips on memory modules historically store timing parameters, voltage profiles, and manufacturer memory capacity. Standardized under JEDEC guidelines, modern memory architectures were intended to enforce write protections on these modules after factory programming to prevent unauthorized hardware manipulation at run-time.

Exploiting this memory loophole could allow adversaries to reactivate obsolete drivers with known security holes, disarm installed anti-malware tools, breach Virtualization-Based Security enclaves, alter enterprise device management configurations, and evade kernel-level anti-cheat engines integrated into modern video games.

Professor Tom Chothia of the University of Birmingham emphasized that executing the exploit merely requires a script capable of being launched remotely, contrasting with earlier hardware memory attacks that demanded direct physical proximity. He further highlighted that prominent memory manufacturers, such as Corsair, G.Skill, and ADATA, distribute at least one product lineup containing write-unprotected configuration chips in clear breach of JEDEC standards.

Formally designated as CVE-2026-23670, both Microsoft and Corsair have publicly acknowledged the security flaw. While Microsoft implemented protective mitigations within its April 2026 security update, Corsair incorporated an option into its iCue utility allowing hardware owners to lock write protection on their DIMM modules, a functionality similarly integrated by diagnostic software utility HWiNFO for non-Corsair hardware.

In summary, cybersecurity analysts have documented three distinct vectors capable of granting intruders system-level privileges on fully updated Windows systems. These attack vectors—comprising the hardware-focused “Download More RAM” SPD exploit, the “ShieldBreak” zero-day vulnerability in Defender, and the remote “plug and pwn” driver deployment method over RDP—underscore how hardware trust boundaries and elevated software permissions continue to present severe security risks across modern computing platforms.