A security researcher has publicly demonstrated a software‑only partial jailbreak of Nintendo’s upcoming Switch 2 console. The exploit provides what the researcher describes as “userland” access, allowing the execution of homebrew software, reverse engineering of games, backup of save files, and direct control of most console peripherals through memory‑mapped I/O.
Exploit foundation in SmileBasic 4
The jailbreak hinges on SmileBasic 4, the latest iteration of a long‑standing series of programming environments that run on Nintendo hardware. SmileBasic 4 operates as a user‑level interpreter, and the researcher leveraged a “tethered” approach that also requires a macOS or Linux computer on the same network. A node.js package running on the host machine coordinates with the console to elevate privileges.
Researcher Sammy Hajhamid, known online as Pepsipu, employed OpenAI’s Codex to probe the SmileBasic language interpreter. By crafting a custom harness capable of issuing USB commands and capturing HDMI output—while also cycling power via a Bluetooth‑controlled light switch—he spent roughly two weeks searching for exploitable bugs.
The effort uncovered a 32‑bit integer overflow that occurs when items are removed from an array inside SmileBasic. This overflow exposes an array pointer, granting read and write access to portions of the system’s memory. With this foothold, Hajhamid began targeting internal system modules for deeper access.
Privilege escalation via filesystem services
Continuing his investigation, Hajhamid identified a buffer overflow in the console’s FileSystem services module. The flaw revealed a cached data pointer, which in turn allowed arbitrary memory reads and writes. By manipulating this pointer, he could perform privileged filesystem actions and ultimately achieve native code execution by masquerading a process as a legitimate filesystem operation.
These steps collectively constitute a partial jailbreak: the exploit does not grant full kernel‑level control, but it does provide sufficient authority to run unsigned code, modify game data, and interact with hardware components beyond the restrictions imposed by the official firmware.
Proof‑of‑concept and community reaction
To demonstrate the capabilities of the exploit, Hajhamid showcased a set of custom‑modded characters in Mario Kart World, running on an exploited Switch 2. Other developers have begun releasing simple demos and early‑stage tools that operate on the compromised hardware, indicating rapid community interest.
The discovery highlights both the ingenuity of the homebrew community and the challenges Nintendo faces in securing a next‑generation console. While the current method requires a tethered setup and a compatible PC, it opens a pathway for further research that could lead to more autonomous jailbreak solutions.
As the Switch 2 approaches wider release, the exploit may pressure Nintendo to reassess its security architecture, especially the reliance on legacy development environments like SmileBasic. For now, the partial jailbreak stands as a notable milestone in console hacking, offering users unprecedented access to modify and extend the functionality of the upcoming handheld.
Norman Pearlstine is the Executive Editor and Co-Founder at News Raise. With over two decades of experience across financial journalism, corporate governance, and market analysis, Norman leads the editorial direction and ensures strict adherence to journalistic accuracy and ethics.
