Windows 11 gets April 2026 patches: a RAM flaw can bypass VBS

Microsoft rolled out the April 2026 security patches for Windows 11, and one of the bigger fixes targets CVE-2026-23670, a hardware-assisted way to get around Virtualization-Based Security, or VBS. Researchers found that some DDR4 and DDR5 memory modules allow software to rewrite Serial Presence Detect (SPD) data. Once an attacker already has administrator access, they can use that to trick the PC into reporting more RAM than it actually has.

From there, things get ugly fast. The fake memory map creates aliased memory regions, which can let an attacker slip past Windows 11’s VBS without ever touching the hardware. No need to open the case. The researchers also say the same setup can disrupt Microsoft Defender, Sophos Intercept X, and even kernel-level anti-cheat protections.

The hardware in question includes certain modules from Corsair, G.Skill, and ADATA. In those cases, SPD write access wasn’t properly locked down, even though JEDEC guidance says it should be.

Microsoft says the patch does its job on systems where Secure Boot is turned on. The researchers aren’t fully convinced. They describe the fix as partial and say PCs running without Secure Boot could still be vulnerable.

If VBS is part of your security setup, if you’re running workloads that actually need that protection, or if you’re responsible for enterprise PCs, this is an update you shouldn’t put off.

Install the April 2026 Windows 11 updates through Windows Update. If your system uses affected hardware, there are extra steps too: Corsair has an SPD write-protection tool, and Gigabyte has released motherboard firmware updates.