# Security researcher demonstrates Switch 2 homebrew exploit using SmileBasic interpreter flaw

A 32-bit integer overflow discovered with AI assistance enables userland code execution, save file extraction, and game modding, prompting Nintendo to delist the software.

- Canonical: https://reviewblip.com/news/security-researcher-demonstrates-switch-2-homebrew-exploit-using-smilebasic-interpreter-flaw/
- Published: 2026-10-25T06:19:58.533Z
- Updated: 2026-10-25T06:19:58.533Z
- Author: ReviewBlip
- Category: Gaming Hardware & Security
- Type: News

![Nintendo Switch 2 console running custom modded character proof-of-concept in Mario Kart World](https://reviewblip.com/editorial-images/2cb34880aa19972bac064d62d1a5686efd0554d9e7f09896223784fd10e9a286)

Image credit: Ars Technica / Pepsipu.com / Sammy Hajhamid — console security research proof-of-concept

Independent security researcher Sammy Hajhamid, known online as Pepsipu, has published proof-of-concept documentation detailing a software-only partial jailbreak of the Nintendo Switch 2 console. The vulnerability grants persistent "userland" execution privileges, allowing researchers and developers to run unsigned homebrew code, dump unencrypted save files, mod retail game assets, and directly query console peripheral controllers via memory-mapped I/O.

The exploit chain targets SmileBasic 4, an authorized programming environment and BASIC language interpreter published on Nintendo platforms. Hajhamid constructed an automated testing harness powered by OpenAI’s Codex, which transmitted systematic USB inputs and analyzed live HDMI capture frames over a two-week fuzzing campaign. The automated harness successfully isolated an unhandled 32-bit integer overflow triggered during array item deletions, revealing an arbitrary pointer that allowed read-and-write manipulation of heap memory.

By chaining the interpreter flaw with a secondary buffer overflow inside the Switch 2’s FileSystem services module, Hajhamid was able to bypass userland sandboxes, spoof filesystem processes, and achieve native code execution. As a demonstration, Hajhamid published video verification showing custom community character models seamlessly injected into Mario Kart World without requiring physical hardware modifications or soldered modchips.

Nintendo responded swiftly to the disclosure, removing SmileBasic 4 from the Switch eShop globally to restrict further distribution. While the current vulnerability remains tethered to a local network companion script and stops short of kernel-level bootrom control, security analysts note that achieving userland execution just over twelve months into the console’s lifecycle presents an urgent software defense challenge for Nintendo as imminent system firmware revisions prepare to patch the vector.

## Sources
- [\[src-switch2-smilebasic-hack\] Switch 2 security takes a hit as hackers unlock homebrew access](https://arstechnica.com/gaming/2026/10/switch-2-jailbreak-gives-hackers-new-ways-to-run-homebrew-and-mod-games/)