Nintendo Switch Owners Should Update Their Firmware

Owners of the original Nintendo Switch are urged to update their firmware immediately to address a security exploit, particularly if they game in public places. This vulnerability was disclosed by Nintendo on September 10 and arises from the Send to Smartphone feature, which creates a QR code on the Switch that can be scanned by a smartphone.

Scanning this code enables the transfer of game captures and screenshots to a phone, but it also poses a risk of unauthorized access if someone else intercepts the QR code. Furthermore, the exploit is relevant to those playing Super Mario Kart: Home Circuit on the physical cartridge, as this game utilizes a QR code for establishing a wireless connection with nearby players.

By allowing another device to scan the QR code, an attacker could connect their device to the Switch and execute unauthorized code or steal sensitive information stored on the console. The Nintendo Switch 2 is not impacted by this exploit.

Fortunately, the solution is straightforward. Nintendo has released firmware update 23.0.0 on September 9 to patch the vulnerability, identified as CVE-2026-82079. This issue is classified as a stock-based buffer overflow vulnerability and allows attackers within wireless range to execute malicious code. Only the original Nintendo Switch running firmware versions prior to 23.0.0 is susceptible to this security flaw.

To install the update, navigate to System Settings, then System, and finally System Update. Adhere to any on-screen instructions to complete the installation process.

If immediate update is not feasible, users can mitigate the risk by restricting the use of the Send to Smartphone feature to home environments, where potential attackers cannot intercept the QR code, or by refraining from playing Super Mario Kart: Home Circuit in public settings. Additionally, Nintendo advises against scanning QR codes with any device other than one's own. Those who predominantly play games at home are not affected by this exploit and do not need to take any additional precautions.