Nintendo Switch QR Code Vulnerability Lets Nearby Attackers Execute Unauthorized Code
Nintendo patched CVE-2026-82079 (CVSS 8.4), a stack buffer overflow in Switch local wireless pairing enabling nearby attackers to execute code.
Nintendo Switch system update 23.0.0 fixes CVE-2026-82079, a stack-based buffer overflow in local wireless networking abused via the QR code sharing process, including Album's 'Send to Smartphone' and Mario Kart Live pairing. A nearby attacker who scans the displayed QR code can send crafted traffic and use return-oriented programming to achieve arbitrary code execution. CVSS scores are 8.4 (v3.1) and 7.0 (v4.0), both rated High. No in-the-wild exploitation is reported and Switch 2 systems are not affected.
- Stack buffer overflow in Switch local wireless networking, fixed in firmware 23.0.0
- Exploitation requires wireless proximity plus scanning the displayed QR code
- CVSS 8.4 (v3.1) and 7.0 (v4.0), both rated High
- No in-the-wild exploitation, malware payloads or campaigns observed
- Switch 2 consoles are not vulnerable to this issue
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82079 | Stack Buffer Overflow in Nintendo Switch Local Wireless Enables Nearby-Attacker RCE | 7.0 | — |
From the original article
2 min read at gbhackers.com
Nintendo released system version 23. 0. 0 to address CVE-2026-82079, a vulnerability in the Nintendo Switch’s local wireless networking that could turn the QR code sharing process into an attack vector.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.