Security researcher achieves first software userland exploit on Nintendo Switch 2 via SmileBasic
Integer overflow discovered using AI-assisted fuzzing allows native code execution, save-game backup, and game modding on firmware 23.0.1.
Technology news
Independent cybersecurity researcher Sammy Hajhamid, known online as Pepsipu, has published proof-of-concept documentation detailing the first successful software-only userland jailbreak for Nintendo's flagship Switch 2 console. Operating entirely within software on the latest official system firmware 23.0.1, the tethered exploit grants homebrew enthusiasts arbitrary memory access, enabling native code execution, local save-game extraction, and real-time game asset modification without requiring physical hardware alteration.
The breakthrough vulnerability resides in SmileBasic 4, a popular interactive programming environment originally published for the Nintendo Switch that runs via backward compatibility on the Switch 2. Hajhamid identified the security flaw by constructing an automated fuzzing harness powered by OpenAI's Codex, which programmatically dispatched USB inputs and analyzed video telemetry over HDMI. After two weeks of continuous fuzzing, the automated rig isolated a 32-bit integer overflow triggered when removing elements from a dynamic array within the SmileBasic byte-code virtual machine.
By chaining the array integer overflow with a secondary buffer overflow in the console's internal FileSystem services module, the exploit gains read-and-write permissions across system memory buffers and achieves arbitrary native execution through a spoofed filesystem process. As a proof of concept, Hajhamid demonstrated custom modded player characters and custom tracks operating natively inside Mario Kart World, while other developers verified full Vulkan GPU access in userland.
Nintendo moved swiftly to mitigate the vulnerability, delisting SmileBasic 4 from the Nintendo eShop globally to restrict new installations. Unlike the notorious 2018 fusée gelée vulnerability that permanently compromised original Switch models at the hardware bootrom level, this userland exploit remains confined within the operating system sandbox and can be patched via an upcoming firmware release. Nonetheless, the rapid exploitation of the Switch 2 within its early lifecycle signals an intensifying battle between console security architects and the reverse-engineering community.