On September 10, 2026, Nintendo published a security advisory for the original Nintendo Switch, disclosing a stack-based buffer overflow vulnerability (CVE-2026-82079) present in the console's local wireless communication feature. The flaw affects units running system versions below 23.0.0, and Nintendo is urging users to immediately apply the latest firmware, version 23.0.0, which contains the fix.
Unlike typical remote attacks carried out over the internet, this vulnerability can only be exploited under a narrow set of conditions: the attacker must be within physical range of the console's wireless signal, and must be able to directly view a QR code displayed on screen. However, if these conditions are met, an attacker can send specially crafted wireless packets to corrupt the stack and use Return-Oriented Programming (ROP) to execute arbitrary code, potentially extracting sensitive information stored on the device. This article examines why an ad hoc proximity communication feature—originally built for convenience—became an attack vector, along with the technical structure and assessment behind the disclosure.
The blind spot in proximity wireless features: album transfer and Mario Kart
According to Nintendo's official advisory, this vulnerability can only be exploited in two specific scenarios:
- When using the "Send to Smartphone" feature within the Album app
- When using a kart in Mario Kart Live: Home Circuit
What both scenarios have in common is that the Nintendo Switch console establishes a temporary ad hoc wireless connection with an external device.
The "Send to Smartphone" feature built into the original Nintendo Switch's Album app allows photos and videos to be transferred directly between the console and a smartphone. During this process, the Switch console operates as a temporary Wi-Fi access point (SoftAP). The first QR code displayed on screen embeds the connection SSID and encryption key (WPA key), which the smartphone reads to join the ad hoc local wireless network. A second QR code, displayed afterward, contains the local URL (over HTTP) of a lightweight web server running inside the Switch. The protocol is designed so that a browser accesses this server to download the image data.
Mario Kart Live: Home Circuit, on the other hand, is a title in which a physical RC kart equipped with a camera wirelessly links with the Switch console to project an AR racetrack onto a real room. At the start of the game, a connection QR code appears on the Switch's screen (or on a TV connected via the dock). This code is read by the physical kart's camera, completing the local wireless pairing between the kart and the console and initiating low-latency video streaming along with the exchange of driving control commands.
At the core of the issue is a flaw in how these temporary wireless network environments handled data received from connecting external devices. While the system was designed to only accept connections from a legitimate smartphone or a properly paired kart, a malicious third party who directly reads the on-screen QR code could join the temporary network and send crafted, malformed packets to the receiving daemon.
In its advisory, Nintendo emphasizes: "If you are using this feature in an environment where the QR code displayed on the console screen (or on the TV) cannot be viewed by a third party, this vulnerability cannot be exploited." While exploitation is difficult in an isolated setting such as a private home, the blind spot emerges in public spaces or offline events, where exposing the QR code to bystanders turns it into a prime entry point for a nearby attacker.
From stack corruption to ROP chains: how control was hijacked
According to the official CVE record, CVE-2026-82079 is classified under CWE-121 (Stack-based Buffer Overflow), with an attack pattern corresponding to CAPEC-100.
A stack buffer overflow is a classic memory corruption flaw in which a program writes external data beyond the bounds of a fixed-length buffer allocated on the stack. In the Switch's local wireless communication processing, the length of received frames or HTTP request headers was not properly validated before being copied into a stack buffer, resulting in the overwriting of adjacent frame pointers or function return addresses.
Modern operating systems standardly implement the NX bit (Data Execution Prevention, DEP) to prevent malicious shellcode injected onto the stack from being executed directly. The Nintendo Switch's Horizon OS—a proprietary microkernel-based operating system—likewise protects stack regions as non-executable, and further employs ASLR (Address Space Layout Randomization) to prevent memory layouts from being predictable.
To bypass these layered defenses, attackers use a technique called Return-Oriented Programming (ROP). ROP works by arranging, on the stack, the addresses of small existing instruction sequences already present in executable memory regions (such as shared libraries or code segments)—short instruction chains ending in a "ret" instruction, known as "gadgets"—and chaining function returns together to assemble arbitrary behavior without ever executing the stack region itself.
In CVE-2026-82079, an attacker could use crafted packets to overwrite the return address on the stack with the address of a chain of ROP gadgets, completely hijacking the program's execution control. This takeover of control creates the potential for privilege escalation or unauthorized calls to internal system APIs, risking the exfiltration of save data, encryption keys, account credentials, or device-specific telemetry data stored on the console.
Why CVSS 4.0 and 3.1 scores diverged on severity
One notable technical aspect of this disclosure is the divergence in CVSS (Common Vulnerability Scoring System) scores among different security assessment bodies.
In assessing CVE-2026-82079's severity, Nintendo's CNA calculated a CVSS 4.0 score of 7.0 (High, Adjacent network / passive user interaction), while CISA's ADP calculated a CVSS 3.1 score of 8.4 (High, Local / no user interaction). The two ratings diverge on whether the requirement of visually scanning a QR code should be classified as part of the attack vector or as user interaction.
| Assessor / Standard | Base Score | Attack Vector | User Interaction | Impact |
|---|---|---|---|---|
| Nintendo CNA (CVSS 4.0) | 7.0 (High) | Adjacent network (AV:A) | Passive (UI:P) | VI:H / VC:L / VA:L |
| CISA ADP (CVSS 3.1) | 8.4 (High) | Local (AV:L) | None (UI:N) | C:H / I:H / A:H |
The CVSS 4.0 vector calculated by Nintendo itself as the CVE Numbering Authority (CNA) (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N) accurately reflects the real-world constraints on the attack conditions.
First, the Attack Vector is rated as Adjacent network (AV:A), since the attacker must be within physical range of the Wi-Fi signal to communicate at all. User Interaction is assigned as Passive (UI:P), since the attacker cannot initiate a local wireless session unless the user deliberately displays the QR code on screen and places the device into a waiting-for-connection state. Furthermore, under CVSS 4.0's fine-grained impact categories, integrity impact (VI:H) is rated high, while confidentiality (VC:L) and availability (VA:L) impacts are rated as limited, resulting in a base score of 7.0.
By contrast, the CVSS 3.1 vector calculated by the U.S. CISA's ADP (Authorized Data Publisher) (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) treats the physical proximity required to view the screen as Local access (AV:L), and classifies it as No user interaction (UI:N) since the user does not actively perform an action such as clicking a malicious link. On top of this, given the potential for the code execution to compromise the entire system, all impact categories were rated High, pushing the score up to 8.4.
The predicted EPSS (Exploit Prediction Scoring System) score, calculated by third-party vulnerability databases, remains as low as approximately 0.16%. EPSS is a statistical model that predicts the probability of in-the-wild exploitation, and this low figure underscores just how high the bar is: an attack can only succeed if two physical constraints—being within Wi-Fi range and directly viewing the QR code—are satisfied simultaneously.
Switch 2's security boundary and what users should do
In the affected products section of the official advisory published by Nintendo, an especially notable remark is included.
"Note: On Nintendo Switch 2, there is no risk of device information being obtained."
Nintendo has officially stated that on its next-generation platform, Nintendo Switch 2, there is no risk of this vulnerability being exploited to extract information from the console. This statement suggests that Switch 2 does not simply reuse the firmware or communication stack of the original Switch, but instead has established a robust security boundary at the architectural level.
Specifically, this could be interpreted as the result of measures such as thorough privilege separation of the daemon handling local wireless communication, tightened restrictions on inter-process communication (IPC), the adoption of modern compiler-based stack protections (Stack Canaries) and Control Flow Integrity (CFI), or a redesign of the Wi-Fi Direct pairing protocol itself—all of which would prevent ROP chaining or memory leaks from becoming possible even if a buffer boundary violation were attempted.
On the other hand, for the widely used original Nintendo Switch around the world, prompt patch application remains the only fundamental countermeasure.
Nintendo implemented the fix for this stack buffer overflow in system version "23.0.0," which began rolling out on September 10, 2026. Users should check their console's update status using the following steps and apply the update if it has not already been installed.
- Open "Settings" from the HOME Menu.
- Select "System" from the left-hand menu.
- Confirm that the displayed "Current System Version" is "23.0.0" or higher, and if not, start the manual update process from "System Update."
Consoles connected to the internet will typically download update data automatically, but caution is warranted for consoles used exclusively offline in handheld mode, as updates may remain pending in such cases.
As a temporary workaround for users unable to immediately apply the system update, Nintendo has requested the following operational precautions:
- When using the Album app's "Send to Smartphone" feature or Mario Kart Live: Home Circuit, only do so in an environment where the QR code displayed on screen or on the TV cannot be seen by a third party.
- Do not use any smartphone other than your own when using the Album's transfer feature.
- Do not use any kart other than your own legitimately owned kart with Mario Kart Live.
The QR code displayed on screen is not merely a web link—it is itself the secret key information that allows the console to establish an encrypted, authenticated local wireless link with an external device. Even in familiar, everyday physical spaces, handling the proximity protocols that support a game console's convenience requires an appropriate level of security awareness.