Security researchers have demonstrated a software-only partial jailbreak of the Nintendo Switch 2, gaining what is described as “userland” access. The exploit, which relies on a flaw in the SmileBasic programming interpreter, allows users to run homebrew applications, modify games, and back up save files.
The demonstration was led by a researcher known online as Pepsipu, who identified a 32-bit integer overflow within the SmileBasic 4 interpreter. This specific error occurs when items are removed from an array, granting unauthorized read and write access to portions of the console’s system memory. The process required a custom harness to send USB commands and view results via HDMI, taking approximately two weeks of effort to isolate the vulnerability.
SmileBasic Vulnerability Details
The attack chain begins with the SmileBasic 4 interpreter, a legacy tool originally designed for the Nintendo 3DS. The 3DS version of the software was previously used in the “smilehax” exploit in 2016, leading Nintendo to remove it from the 3DS eShop. Similarly, SmileBasic 4 has been delisted from the Switch 2 eShop worldwide, though a Japanese demo version remains accessible.
Once the integer overflow was triggered, the researcher targeted the console’s internal system modules. A buffer overflow in the FileSystem services module exposed a cached data pointer. This discovery granted arbitrary read and write privileges, allowing the execution of privileged filesystem actions. The final step involved executing native code through a faked filesystem process, achieving the necessary userland access.
The exploit is described as “tethered,” meaning it requires a macOS or Linux PC on the same network to run a node.js package that facilitates privileged system access. While this limits the ease of use for casual users, it provides a functional proof of concept for the broader hacking community.
Impact on Switch 2 Security
The demonstration included modded characters in Mario Kart World, serving as a visible proof of concept. Other community members have since shared simple demos and in-progress developer tools running on exploited hardware. However, the current “userland” exploit keeps developers within a relatively small sandbox. It falls short of the kernel-level access that would provide full control over the console’s hardware.
This incident marks a significant milestone in the ongoing cycle between console hackers and hardware manufacturers. The Switch 2 has been on the market for just over a year, and the ability to bypass security measures so quickly suggests vulnerabilities in the system software. Unlike the original Switch, which required a hardware redesign to address an unpatchable exploit in 2018, this issue is software-based.
Nintendo is expected to patch this vulnerability in imminent firmware updates. The current exploit works on firmware version 23.0.1, but continued access to Nintendo services and future game releases will likely require updating to patched versions. The delisting of SmileBasic 4 may slow the spread of this specific exploit to the wider base of owners who have not previously downloaded the software.
Despite the limitations of the current hack, the discovery highlights the persistent challenges in maintaining console security. Other researchers are already teasing similar exploits that may work using different games. The cycle of discovery and patching is expected to continue as the community pushes for deeper access to the Switch 2 platform.
Source: Ars Technica
