Nintendo has patched a high-severity vulnerability in the Nintendo Switch that could allow nearby attackers to execute unauthorized code or access information stored on affected consoles by abusing QR-code-based local wireless connections.
Tracked as CVE-2026-82079, the flaw affects Nintendo Switch systems running firmware versions earlier than 23.0.0.
Nintendo released system update 23.0.0 on September 10 to address the issue, which is classified as a stack-based buffer overflow in the console’s local wireless networking functionality.
Nintendo Switch Vulnerability
The attack is limited to specific scenarios in which a QR code is displayed on the Nintendo Switch console or a connected television.
These QR codes are generated when users employ the Album application’s “Send to Smartphone” function to transfer screenshots or video clips, or when pairing a kart accessory for Mario Kart Live: Home Circuit.
Nintendo warned that an attacker must directly scan the QR code shown on the screen to exploit the vulnerability. If that condition is met, the company said a third party may be able to run unauthorized code on the victim’s Nintendo Switch or obtain information stored on the device.
The threat model therefore requires physical proximity, visual access to the QR code, and wireless range of the targeted console.
Technically, CVE-2026-82079 is a stack-based buffer overflow, cataloged as CWE-121. Such flaws occur when software writes more data into a stack memory buffer than it was designed to hold, potentially overwriting adjacent memory.
An attacker within wireless range could send specially crafted network traffic to trigger the overflow and use return-oriented programming, or ROP, to execute arbitrary code.
ROP chains together legitimate instruction sequences already present in memory, allowing an attacker to bypass restrictions on directly injecting executable code.
Nintendo’s CVSS v4 base score for the vulnerability is 7.0, rated High. The assigned vector indicates an adjacent-network attack, low attack complexity, no required privileges, and user interaction.
Although the exploit is not broadly exposed over the internet, the combination of local wireless access and QR-code pairing creates a notable risk in public environments such as gaming events, transit locations, shared spaces, or retail settings.
The vulnerability highlights how QR codes can function as more than passive links. In this case, the QR code supports a local connection workflow, giving an attacker an opportunity to interact with the Switch’s wireless networking stack if they can scan the code before or alongside the legitimate user.
Nintendo Switch owners should immediately update to system version 23.0.0 through System Settings > System > System Update.
Until patched, users should avoid displaying QR codes where untrusted people can view them, use only their own smartphones for the Album transfer feature, and avoid pairing Mario Kart Live: Home Circuit karts in public or uncontrolled environments. The affected product range is Nintendo Switch versions prior to 23.0.0.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
