Nintendo Switch Vulnerability Allows Attackers to Run Unauthorized Code on Your Console
Nintendo patched CVE-2026-82079, a CVSS 7.0 stack buffer overflow in original Switch local wireless allowing nearby code execution via QR-code workflows.
Nintendo patched CVE-2026-82079 (CVSS 4.0 base score 7.0, High), a stack-based buffer overflow in the original Switch's local wireless networking affecting firmware earlier than 23.0.0. An adjacent attacker must scan a QR code displayed by the console, via the Album "Send to Smartphone" feature or Mario Kart Live: Home Circuit, before crafted packets can corrupt memory and enable return-oriented programming for arbitrary code execution. EPSS is approximately 0.16%, Switch 2 is not affected, and Nintendo's advisory was published September 10, 2026.
- Stack-based buffer overflow in local wireless networking; CVSS 4.0 score 7.0.
- Exploitation requires wireless proximity plus QR code scan of console workflows.
- Affects original Switch firmware below 23.0.0; Switch 2 unaffected.
- EPSS approximately 0.16%; low 30-day exploitation forecast.
- Patch available in system update 23.0.0.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82079 | Stack Buffer Overflow in Nintendo Switch Local Wireless Enables Nearby-Attacker RCE | 7.0 | — |
From the original article
2 min read at cybersecuritynews.com
Nintendo has patched a high-severity vulnerability in the original Nintendo Switch that could let a nearby attacker execute unauthorized code and access information stored on the console. Tracked as CVE-2026-82079, the flaw affects firmware earlier than 23. 0.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.