Switch 2 security bypassed in software-only jailbreak

According to Hajhamid's research, the exploit leverages the original Switch version of SmileBasic 4, a programming interpreter that runs on Nintendo's hardware. By sending USB commands to the system and observing output via HDMI, Hajhamid's custom harness identified an integer overflow that occurs when items are removed from an array in SmileBasic. This error provides access to an array pointer, enabling read-write access to system memory.

The jailbreak is described as "tethered", meaning it requires a constant connection to a separate computer running a node.js package to enable privileged system access. Hajhamid noted that the setup also used a Bluetooth light switch for power cycling.

Hajhamid stated that the access "lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2's peripherals through MMIO." The exploit is currently limited to userland and does not provide full system control.

Nintendo has not yet responded to the development.

Analysis

Why This Matters

The jailbreak opens the door for unauthorized homebrew and potentially piracy on the Switch 2.
Nintendo is likely to respond with firmware updates, escalating the cat-and-mouse game between the company and the modding community.
The exploit demonstrates that third-party interpreters can introduce security holes even in locked-down systems.

Background

Nintendo consoles have a long history of jailbreaks, from the original Switch's multiple exploits to earlier handhelds. SmileBasic is a long-running series of programming environments that have been available on Nintendo platforms, often used for educational purposes. The Switch 2 launched with a strong focus on security, making this partial break notable.

Key Perspectives

Nintendo: The company typically opposes unauthorized access and is expected to patch this vulnerability in a future firmware update.
Homebrew community: Enthusiasts see this as a major step toward running custom software, mods, and backups on the Switch 2.
Security researchers: The exploit highlights the importance of auditing interpreters and third-party code for memory safety issues.

What to Watch

Whether Nintendo releases a firmware update that closes the SmileBasic vulnerability.
If other researchers build on this work to achieve a full, untethered jailbreak.
Any legal or policy response from Nintendo, including potential takedown of the researcher's tools.

Checked

11 claims in this story checked against 1 source: 6 supported.

Show each claim

Partly supportedThe Switch 2’s security was bypassed in a software-only jailbreak.Ars Technica - All content: “A security researcher has demonstrated a software-only partial jailbreak of the Switch 2, gaining "userland" access”
SupportedResearcher Sammy Hajhamid demonstrated a software-only partial jailbreak of the Switch 2.Ars Technica - All content: “A security researcher has demonstrated a software-only partial jailbreak of the Switch 2”
SupportedThe jailbreak exploits a 32-bit integer overflow in SmileBasic 4.Ars Technica - All content: “that harness discovered a 32-bit integer overflow that occurs when removing items from an array in SmileBasic.”
Partly supportedOpenAI’s Codex assisted in discovering the vulnerability.Ars Technica - All content: “Sammy Hajhamid writes that he used OpenAI's Codex to poke at SmileBasic's language interpreter”
SupportedThe exploit provides userland access that enables homebrew, game modding, save backups and peripheral access.Ars Technica - All content: “gaining "userland" access that he says "lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2’s peripherals through MMIO."”
SupportedThe hack requires a tethered connection to a macOS or Linux PC on the same network.Ars Technica - All content: “The so-called "tethered" hack also requires access to a macOS or Linux PC on the same network to run a node.js package”
SupportedThe harness sent USB commands to the system and viewed results via HDMI.Ars Technica - All content: “using a custom harness that could send USB commands to the system and view results via HDMI”
Not in the sourcesThe tethered setup requires a constant connection to the computer.Ars Technica - All content: “The so-called "tethered" hack also requires access to a macOS or Linux PC on the same network to run a node.js package”
SupportedHajhamid used a Bluetooth light switch for power cycling.Ars Technica - All content: “as well as power cycling via a Bluetooth light switch flipping device”
Not in the sourcesNintendo has not yet responded to the development.
Partly supportedThe exploit is limited to userland and does not provide full system control.Ars Technica - All content: “A security researcher has demonstrated a software-only partial jailbreak of the Switch 2, gaining "userland" access”