Three new Windows vulnerabilities threaten user security
Windows users are facing a new series of security issues that demonstrate that installing the latest updates does not always eliminate all risks. At least three Windows vulnerabilities presented in 2026 can be exploited for bypassing security mechanisms, gaining system privileges, and, in certain scenarios, installing malware remotely. The information was presented by TechSpot on August 15, 2026, and is based on security research recently presented or reported.
Three different Windows vulnerabilities
The three issues are of different natures. The first, aptly named “Download More RAM”, exploits how certain memory modules report the RAM configuration to the system. The second is the vulnerability ShieldBreak, a zero-day associated with Microsoft Defender. The third, described as a “plug and pwn” attack, exploits the automatic process by which Windows identifies hardware and installs drivers.
Important for users: the existence of these vulnerabilities does not mean that any Windows PC is automatically compromised. The risk depends on the system version, hardware configuration, active protective measures, and the conditions necessary for exploitation.
1. “Download More RAM” can manipulate PC memory information
The first vulnerability, identified as CVE-2026-23670, was presented at the USENIX Security Symposium 2026 by researchers from the University of Birmingham and Durham University. The issue is related to the Serial Presence Detect (SPD) chip found on RAM modules.
Normally, the SPD chip provides the system with information about the characteristics of the installed memory. However, researchers demonstrated that certain modules use configuration chips that do not benefit from the write protection recommended by JEDEC standards. Under certain conditions, an attacker can modify this information and cause the system to believe that the PC has more memory than it actually does.
The problem is more serious than it seems at first glance. According to researchers, modifying the data can cause the memory controller to create pseudo-addressable addresses that overlap with real addresses. These aliases can be used to create a memory access path that bypasses certain security mechanisms of the operating system and processor.
In an attack scenario, the consequences can include reactivating vulnerable drivers, disabling anti-malware mechanisms, compromising security enclaves based on virtualization, or altering device management settings. Researchers claim that the attack can be initiated through a remotely distributed script, making it more interesting from a security perspective than traditional attacks that required physical access to the PC.
Microsoft has acknowledged the issue and introduced mitigation measures in the April 2026 update. Additionally, Corsair has added a feature in its iCUE software that allows enabling write protection for certain compatible modules, while HWiNFO offers a similar feature for users using memory from other manufacturers.
2. ShieldBreak: a zero-day targeting Microsoft Defender
The second issue is ShieldBreak, a zero-day identified as CVE-2026-50656. The vulnerability is classified as a privilege escalation issue and affects Windows 10, Windows 11, and Windows Server, according to information published by TechSpot.
The peculiarity of ShieldBreak is that the attack can bypass a fix associated with a previous vulnerability known as RoguePlanet. If the exploit is executed under the necessary conditions, the attacker can gain system privileges, one of the most powerful levels of access available in Windows.
However, there is an important condition: Microsoft Defender must be active for the described exploitation scenario to work. This does not mean that disabling the antivirus is a solution. On the contrary, disabling security protections can significantly increase the risk in other scenarios.
For regular users, the recommendation is to keep Windows and its security components updated and to monitor the official information published by Microsoft through the Security Update Guide. Microsoft uses this platform to document vulnerabilities and security updates for its products.
3. “Plug and pwn” can install drivers with system privileges
The third vulnerability is different because it exploits the automatic hardware identification and driver installation mechanism in Windows.
Researchers Alejandro Hernando and Borja Martinez presented at DEF CON 34 an attack where a user without administrator privileges and even without an active session can cause Windows to install driver packages signed by manufacturers. The problem is that these drivers can be loaded with system-level privileges.
More concerning, the researchers’ demonstration shows that the attack is not limited to physically connecting a USB device. In the presented scenario, the technique can be exploited remotely via RDP, without the attacker actually connecting a USB device to the target computer.
This case highlights an important security issue: mechanisms designed for user convenience, such as automatic hardware detection and driver installation, can become an attack surface when the trust chain is exploited.
What should Windows users do?
The three vulnerabilities have different exploitation mechanisms, so there is no single measure that can eliminate them all. However, users and IT administrators can reduce risk through some basic practices.
First, install the available Windows updates. Microsoft uses security updates to fix vulnerabilities and introduce additional protective mechanisms. In 2026, the company also implemented hardening changes for administrative actions, aimed at reducing the risks of privilege escalation and unauthorized access.
Second, check the firmware and software of hardware components. In the case of the “Download More RAM” vulnerability, protection may also depend on the RAM module and the manufacturer’s tools.
Third, limit the use of RDP. Remote Desktop Protocol should be exposed to the internet only when absolutely necessary and should be protected by strong authentication, restrictive access policies, and ideally, access through a VPN or other controlled access mechanism.
Fourth, do not disable Microsoft Defender as a “protection” measure against ShieldBreak. The fact that a vulnerability exploits a security component does not mean that removing that component solves the overall problem. For vulnerabilities of this type, official patches and mitigations are the correct approach.
Why are these Windows vulnerabilities important?
The most interesting aspect of the three cases is that the attacks target different layers of the Windows ecosystem: hardware memory, security software, and driver management system.
This shows that the security of a modern PC does not rely solely on antivirus or operating system updates. A Windows computer is an ecosystem made up of firmware, hardware, drivers, kernel, services, applications, and security mechanisms. A vulnerability in a single element can provide an attacker with a path to much higher levels of access.
Moreover, Microsoft continues to strengthen security mechanisms in Windows. The company described in 2026 changes aimed at reinforcing the trust boundaries between identity, authentication, and User Account Control (UAC), indicating the increasing importance given to privilege escalation attacks.
What the three Windows vulnerabilities demonstrate
The three Windows vulnerabilities presented in August 2026 “Download More RAM”, ShieldBreak and the “plug and pwn” attack demonstrate that modern threats are not limited to classic malware. Attackers may attempt to exploit even RAM memory, antivirus software, or automatic driver installation mechanisms to gain system privileges.
For users of Windows 10 and Windows 11, the most important measure remains keeping the system updated and using recommended security configurations. For organizations, the situation is more complex and requires hardening policies, driver control, limiting RDP, monitoring privileges, and hardware inventory.
Sources: TechSpot.com, Microsoft Security Update Guide
