Switch 2 jailbreak uses SmileBASIC overflow for userland access

What the exploit does

Researcher Sammy Hajhamid, known online as Pepsipu, demonstrated a software-only partial jailbreak of the Switch 2. In his account, the userland access lets users run homebrew, reverse engineer and mod Switch 2 games, back up save files, and reach most peripherals through MMIO.

The hack is tethered: it must be run from a game each time the console starts, and it requires a macOS or Linux PC on the same network running a node.js package that helps enable privileged system access.

How the flaw was found

Hajhamid wrote that he used OpenAI's Codex to probe SmileBASIC's language interpreter, with a custom harness sending USB commands and viewing results over HDMI. After roughly two weeks, the harness surfaced a 32-bit integer overflow triggered by removing items from an array, exposing an array pointer and with it read and write access to parts of system memory.

From there, he located a buffer overflow in the console's FileSystem services module that exposed a cached data pointer, allowing arbitrary read and write. Hajhamid showed modded Mario Kart World characters as a proof of concept, and others posted simple demos and in-progress developer tools.

Limits and patch outlook

The current userland exploit keeps homebrew developers inside a small sandbox and is far short of kernel-level access. SmileBASIC 4 has already been delisted from the Switch eShop worldwide, which could slow wider distribution; a Japanese demo version that may work similarly was still accessible when the story was published.

The exploit works on firmware version 23.0.1, but the vulnerability is expected to be patched in imminent firmware updates, which are required for continued access to many Nintendo services and future games. Other modders are teasing similar exploits using other games.

Not the original Switch's fault

The report describes this as less severe than the unpatchable original Switch exploit from 2018, which required a hardware redesign. Still, it calls hackers reaching this point just over a year after the console's release a poor sign for the impregnability of Nintendo's system software.