Key points
- The exploit targets the SmileBasic 4 interpreter included with the Switch 2.
- Researchers achieved userland access through an integer overflow and a buffer overflow.
- No official patch or security update has been released by Nintendo to address these flaws.
Nintendo Switch 2 owners should be aware of a newly disclosed jailbreak method that targets the SmileBasic 4 programming environment. Security researcher Sammy Hajhamid, known online as Pepsipu, demonstrated this software-only exploit. It grants "userland" access to the console, allowing users to run homebrew applications and modify game files. This access does not provide full kernel-level control over the hardware.
In plain English
The jailbreak works by tricking the SmileBasic interpreter into making a calculation error. Specifically, it exploits a 32-bit integer overflow that happens when items are removed from an array in the code. This mistake reveals memory pointers, letting the attacker read and write to parts of the system. Hajhamid used this access to find a second flaw in the filesystem services module.
The background
Hajhamid developed this exploit over two weeks using a custom testing setup. He employed OpenAI’s Codex to help probe the interpreter for weaknesses. The process involved sending USB commands to the console and viewing results via HDMI. The researcher also used a Bluetooth device to cycle power automatically during testing. This method required a macOS or Linux PC on the same network to assist with the attack.
What changes now
The proof of concept allows users to run modified content, such as custom characters in Mario Kart World. Other developers are already creating tools and demos for the compromised systems. However, the exploit remains tethered, meaning it requires external computer support to function. It does not give hackers complete control over the Switch 2’s core operating system or hardware functions.
Who needs to act first
Teams managing multiple consoles should prioritize isolating devices that run untrusted software. Check whether any systems are connected to networks where unauthorized code could be executed. Back up important save data and game progress immediately, as jailbreaks can corrupt files. Monitor official vendor channels for any upcoming security announcements. Avoid installing third-party tools or homebrew applications until a verified patch is available.
What to do and how to stay safe: Nintendo Switch 2
- Disconnect Switch 2 consoles from the internet if you do not trust the software running on them.
- Keep the console firmware updated whenever the vendor releases an official system update.
- Avoid using third-party jailbreak tools or unofficial software sources on your device.
- Monitor Nintendo’s official security advisories for any patches addressing SmileBasic vulnerabilities.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this exploit allow full control of the Switch 2?
No, the exploit only provides userland access and does not grant kernel-level control.
Is there a patch available for this vulnerability?
No, there is no confirmed fix or security update mentioned in the current reports.
What software is targeted by this jailbreak?
The exploit targets the SmileBasic 4 interpreter included with the Switch 2.
