Switch 2 security takes a hit as hackers unlock homebrew access
Sammy Hajhamid, known online as Pepsipu, demonstrated a “userland” jailbreak for the Switch 2 that does not require hardware modifications. By feeding custom USB commands through a node.js tool running on a macOS or Linux machine, he leveraged OpenAI’s Codex to probe the SmileBasic 4 scripting environment. After two weeks of fuzzing, he uncovered a 32‑bit integer overflow when the interpreter deletes array elements, exposing a pointer that grants read/write to arbitrary memory. Building on that foothold, he identified a separate buffer overflow in the console’s FileSystem services module, which leaked a cached data pointer and allowed privileged filesystem operations, eventually culminating in native code execution via a forged filesystem process. The exploit is tethered—requiring a network‑connected PC—but it already lets users run homebrew, back up saves, and control peripherals through MMIO, as shown by a modded Mario Kart World demo.
This breach arrives at a critical moment for Nintendo, whose first‑generation Switch has been repeatedly hacked since 2018, leading to a thriving homebrew ecosystem and, inevitably, piracy. The Switch 2 was marketed as a “next‑gen” platform with tighter security, yet the reliance on legacy software like SmileBasic 4 created a familiar attack surface. Competitors such as Sony have also faced similar jailbreaks, but Nintendo’s historically rapid firmware patches have kept large‑scale exploits at bay. The current proof‑of‑concept underscores how third‑party development tools—especially those that embed interpreters—can become unintended vectors, and it highlights the cat‑and‑mouse dynamic between console makers and the modding community.
Looking ahead, Nintendo will likely issue a firmware update to patch the integer overflow in SmileBasic 4 and the filesystem buffer overflow, but the patch window may be narrow; the exploit’s reliance on a networked PC could be mitigated by tightening USB and network permissions. Meanwhile, the homebrew scene will probably expand, with developers adapting the exploit to create more sophisticated tools, potentially increasing piracy pressure on upcoming Switch 2 titles. Watch for Nintendo’s response timeline, any official statements about “security updates,” and whether the community can weaponize the MMIO access for peripheral hacking or cheat development.
Key Takeaways
The jailbreak hinges on a 32‑bit integer overflow in SmileBasic 4 and a separate filesystem buffer overflow, providing arbitrary memory read/write and native code execution.
The exploit is tethered, requiring a macOS/Linux PC running a node.js package, but it already enables homebrew, save backups, and peripheral control via MMIO.
Nintendo’s reliance on legacy interpreters in the Switch 2 created a familiar attack surface despite the console’s touted security improvements.
Nintendo’s next firmware patch will be critical; the speed and completeness of that response will shape the homebrew community’s ability to scale the exploit.
About the Source
This analysis is based on reporting by Ars Technica. Here is a short excerpt for context:
"Userland" exploit relies on integer overflow found in "SmileBasic" interpreter.Read the original at Ars Technica
