Nintendo Switch QR Code Vulnerability Lets Nearby Attackers Execute Unauthorized Code
Nintendo patched CVE-2026-82079 (CVSS 8.4), a stack buffer overflow in Switch local wireless pairing enabling nearby attackers to execute code.
Nintendo Switch system update 23.0.0 fixes CVE-2026-82079, a stack-based buffer overflow in local wireless networking abused via the QR code sharing process, including Album's 'Send to Smartphone' and Mario Kart Live pairing. A nearby attacker who scans the displayed QR code can send crafted traffic and use return-oriented programming to achieve arbitrary code execution. CVSS scores are 8.4 (v3.1) and 7.0 (v4.0), both rated High. No in-the-wild exploitation is reported and Switch 2 systems are not affected.
35