Nintendo Switch Vulnerability Allows Attackers to Run Unauthorized Code
A high-severity vulnerability in original Nintendo Switch consoles, patched in firmware 23.0.0, could allow nearby attackers to execute unauthorized code by tricking users into scanning a QR code.
Nintendo has addressed a critical security flaw, CVE-2026-82079, that affected original Nintendo Switch consoles running firmware versions prior to 23.0.0. The vulnerability, a stack-based buffer overflow within the console's local wireless networking capabilities, could permit an attacker within close proximity to execute arbitrary code on the affected device.
The flaw is triggered through a specific interaction: an attacker must be within wireless range and trick the user into scanning a QR code presented on the Switch's screen or a connected television. This QR code would initiate a connection to a malicious device, which then sends specially crafted network packets targeting the vulnerable wireless code. Exploitation is limited to specific workflows, including the Album's "Send to Smartphone" function and the similar capability used with Mario Kart Live: Home Circuit.
Successful exploitation could lead to a compromise of the console's confidentiality, integrity, and availability. Nintendo warns that an attacker meeting the precise conditions might be able to run unauthorized code or access sensitive information stored on the console. However, the requirement for close physical proximity and user interaction via QR code scanning significantly constrains the ease of opportunistic attacks.
Nintendo has assigned CVE-2026-82079 a CVSS 4.0 base score of 7.0, categorizing it as High severity. The attack vector is described as adjacent network, with low complexity, no privileges required, and passive user interaction. The greatest assessed impact is on system integrity. While predictive models indicate a low probability of exploitation in the wild, the potential for code execution remains a significant concern.
This vulnerability specifically impacts original Nintendo Switch models and does not affect the newer Nintendo Switch 2. The issue was reported by external security researchers, and Nintendo released its advisory on September 10, 2026, urging users to update their systems immediately.
To mitigate the risk, users are strongly advised to install system update 23.0.0 as soon as possible. For those unable to update immediately, Nintendo recommends avoiding the affected sharing features, preventing others from viewing or scanning QR codes displayed by the console, using only trusted personal smartphones for Album transfers, and avoiding unfamiliar Mario Kart Live karts. Consoles connected to the internet typically download updates automatically, but users can manually check for updates via the System Settings menu.
The vulnerability highlights the ongoing security challenges in consumer electronics, even in devices not traditionally considered high-value targets for sophisticated cyberattacks. The reliance on user interaction and specific workflows for exploitation underscores the importance of user education and vigilance in preventing social engineering tactics that can lead to security breaches.
By patching this vulnerability, Nintendo aims to protect its user base from potential unauthorized access and code execution, ensuring a more secure gaming experience. The swift response and clear guidance provided by Nintendo demonstrate a commitment to addressing security concerns promptly.