Details of the software exploit
A security researcher known as "Pepsipu" has managed to execute a partial software exploit on the Nintendo Switch 2 platform, granting users access to the system level known as "userland." This exploit allows users to run third-party software (Homebrew), modify game files, extract save files, and access most device peripherals via the MMIO interface.
The exploit relies on a vulnerability in the SmileBasic 4 programming language interpreter, where the researcher used the OpenAI Codex AI model to assist in analyzing the interpreter and discovering a 32-bit integer overflow vulnerability when deleting elements from a programming array. This error resulted in granting read and write permissions to parts of the system memory.
Evolution of the attack and system access
After obtaining an initial entry point, the researcher targeted internal system modules (sysmodules), discovering a buffer overflow vulnerability in the file system services module. This vulnerability enabled the researcher to obtain arbitrary read and write permissions, which ultimately led to the execution of native code via a dummy file system process.
What does this mean for users?
- Limited permissions: The exploit remains confined to a sandbox environment and does not grant attackers kernel-level access, meaning full control over the device hardware remains out of reach.
- Nintendo's actions: The company has already removed the SmileBasic 4 application from the global eShop, a measure similar to what it previously took with the 3DS platform to limit the spread of similar vulnerabilities.
- Future updates: The exploit currently works on firmware version 23.0.1, and Nintendo is expected to release imminent security updates to patch this vulnerability, which will force users to choose between retaining unofficial access or updating to access network services and new games.
Security context
Although this exploit represents a challenge for Nintendo, it differs fundamentally from the original device vulnerability that appeared in 2018, which required a complete hardware redesign to fix. Experts point out that this exploit, which appeared just one year after the device's launch, reflects the ongoing technical struggle between platform developers and software hacking communities, and underscores the need to strengthen software security in future updates.