Was bound to happen sometime.
A tethered software-only exploit called ns2jb has been published for Nintendo Switch 2 on firmware 23.0.1, relying on an integer overflow in the Switch 1 title SmileBASIC 4; Nintendo has begun delisting the game from eShops.
Security researcher Sammy Hajhamid (pepsipu) detailed the chain on October 22, 2026. It begins with a 32-bit integer overflow in SmileBASIC 4’s interpreter (version 4.4.9 referenced), then escalates via filesystem components to enable native code execution, save dumping and asset injection. Demonstrations included modded characters (Cinnamoroll, Peter Griffin, Hatsune Miku and others) in Mario Kart World. The exploit is tethered (requires re-running from the game after each reboot) and does not currently grant full kernel access. Hajhamid used automated testing rigs and AI assistance (OpenAI Codex) during research.
Nintendo responded by removing SmileBASIC 4 from multiple regional eShops (reports confirmed delistings outside Japan in short order; Japanese availability was more limited). Owners who already downloaded the title retain it. This marks the first publicly documented software-only foothold on retail Switch 2 hardware and echoes the 2016 smilehax situation on 3DS. Impact remains limited for average users due to the tethered nature and technical requirements (local PC with Node.js, specific firmware lock, etc.).
NEW RELEASE | Nintendo Switch Sports Resort is Available Now on Nintendo Switch 2
Source: The Verge
Share this:
Discover more from
Subscribe to get the latest posts sent to your email.