Someone left a window open in a treehouse, and your SOC is being asked to board it up
CVE-2026-82079 is a stack-based buffer overflow (CWE-121) in the Nintendo Switch local wireless networking stack, specifically in the Album "Send to Smartphone" and Mario Kart Live: Home Circuit QR-code workflows. An attacker within physical wireless range can send crafted traffic while the victim is actively displaying an on-screen QR code, potentially achieving ROP-based code execution on the console. Affected firmware is all versions prior to 23.0.0, which Nintendo shipped on September 10, 2026.
Nintendo rated this HIGH at CVSS 3.1 8.4 — a defensible score *for a consumer advisory*. But the vendor score describes technical impact on the device itself, not organizational risk. The Nintendo Switch is a handheld gaming console. It is not enterprise infrastructure. It does not join Active Directory, it does not store regulated data, it does not route corporate traffic, and it does not run business workloads. Even if a handful of Switches live in your office break room, they are unmanaged consumer electronics with no lateral-movement path into your environment. The vendor severity is irrelevant to any enterprise patching queue.
3 steps from start to impact.
Physical proximity to target Switch
- Physical proximity to a Nintendo Switch console
- Target console running firmware < 23.0.0
- Attacker must be in the same room or nearby physical space
- Nintendo Switches are consumer devices rarely present in managed enterprise environments
- Even if present (break rooms, demo kiosks), they sit on isolated consumer Wi-Fi, not on corporate VLANs
Victim initiates QR code display
- Victim actively using the specific Album QR or Mario Kart Live feature
- QR code visible on screen or connected TV
- The vulnerable code path is only active during a brief, intentional user action
- An attacker cannot trigger this remotely — social engineering in a physical space is required
- The feature is rarely used; most Switch owners transfer screenshots via microSD or cloud
Transmit crafted wireless traffic to overflow stack buffer
- Custom wireless tooling capable of crafting malicious local-play frames
- Knowledge of memory layout for ROP gadget addresses on the target firmware version
- No public PoC or exploit code exists
- Nintendo's Horizon OS has ASLR; ROP chains must be tailored per firmware revision
- The payload runs in the Switch's sandboxed userland — no pivot to enterprise networks is possible
The supporting signals.
| In-the-wild exploitation | None observed. No campaigns, no threat-actor reporting, no honeypot hits. Consumer gaming consoles are not targeted by APTs or ransomware crews. |
|---|---|
| Proof-of-concept | No public PoC. Researchers who reported the bug to Nintendo are unnamed and have not published exploit code or technical write-ups. |
| EPSS (30-day exploitation probability) | 0.00159 (0.16%) — bottom decile. Consistent with a consumer-device bug requiring physical proximity. |
| KEV status | Not listed. CISA's Known Exploited Vulnerabilities catalog does not track consumer gaming console firmware. |
| CVSS 3.1 vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — AV:L (Local) is key: this is not network-reachable. Scope Unchanged means impact is confined to the Switch itself. |
| Affected versions | Nintendo Switch firmware < 23.0.0 (all models: original, Lite, OLED). Nintendo Switch 2 is not affected. |
| Fixed version | System update 23.0.0, released 2026-09-10. Delivered via standard auto-update over Wi-Fi. |
| Exposure data | Zero enterprise-facing exposure. Shodan/Censys/GreyNoise: N/A — Nintendo Switch consoles do not expose services on the internet. No scanner fingerprints exist. |
| Disclosure date | 2026-09-10 — coordinated disclosure by Nintendo alongside the patch release. |
| Reporting researcher | Unnamed external security researchers per Nintendo's advisory. No independent write-up published as of 2026-09-16. |
noisgate verdict.
The single most decisive factor is that the affected component — a Nintendo Switch gaming console — occupies no enterprise role whatsoever. It is not infrastructure, it stores no corporate data, and successful exploitation yields control of a toy with no lateral-movement path into any managed environment.
Why this verdict
- Enterprise asset scope: zero. The Nintendo Switch is a consumer handheld gaming console. It does not appear in CMDB inventories, is not domain-joined, does not run agents, and is not managed by enterprise MDM. Treating it as enterprise-relevant inflates noise for defenders managing real hosts.
- Role multiplier: not applicable. Walking the high-value role catalog — identity providers, hypervisors, CI/CD, backup, database, EDR, network edge, SCADA — the Nintendo Switch matches *none*. There is no high-value deployment role. The blast radius of full compromise is: one person's saved games and screenshots. Floor override does not apply.
- Physical proximity + user-initiated trigger = near-zero attackability. The chain requires the attacker to be in the same room AND the victim to be actively using a rarely-exercised QR feature. This is not a persistent attack surface.
- No PoC, no wild exploitation, EPSS 0.16%. All exploitation-likelihood signals are at baseline or below. No threat actor has economic incentive to develop Switch exploits for enterprise intrusion.
Why not higher?
There is no scenario in which a Nintendo Switch vulnerability constitutes enterprise risk. The device has no network connectivity to corporate assets, no trust relationships with domain infrastructure, and no data classification above 'personal entertainment.' Raising this above IGNORE would waste SOC cycles on a non-asset.
Why not lower?
IGNORE is already the lowest severity bucket. The vulnerability is technically real — it is a genuine RCE in a shipping product — so it warrants documentation rather than outright dismissal from a CVE-tracking perspective, but no enterprise action is required.
What to do — in priority order.
- No enterprise action required — The Nintendo Switch is not an enterprise-managed asset. If your organization has Switches in break rooms or demo areas, they will auto-update to 23.0.0 over Wi-Fi. No compensating control is needed from an IT security perspective.
- Network segmentation (the Switch is already on a consumer/guest VLAN or personal hotspot — it was never on your corporate network to begin with)
- EDR/endpoint agents (no agent runs on Nintendo Switch; the Horizon OS is a closed platform)
- Vulnerability scanners (Qualys, Tenable, Rapid7 do not have plugins for Nintendo Switch firmware — the device is not in your scan scope)
Crowdsourced verification payload.
There is nothing to verify on enterprise hosts. If for inventory-curiosity reasons you want to confirm a Switch's firmware version, check it physically on the console: System Settings → System → System Update. The script below is a placeholder that documents the non-applicability for audit compliance.
#!/usr/bin/env bash
# CVE-2026-82079 — Nintendo Switch local wireless stack overflow
# This CVE affects a consumer gaming console, NOT enterprise infrastructure.
# There is no programmatic way to scan for Nintendo Switch firmware from
# an enterprise network. This script exists solely for audit documentation.
#
# Manual check: On the Switch, go to System Settings > System > System Update.
# If firmware >= 23.0.0, the device is patched.
echo "CVE-2026-82079 applies to Nintendo Switch firmware < 23.0.0."
echo "This is a consumer gaming device — not an enterprise asset."
echo "No enterprise hosts are affected."
echo ""
echo "RESULT: NOT_APPLICABLE"
exit 0If you remember one thing.
Sources
- CyberInsider — Nintendo warns of Switch code execution flaw via QR codes
- CybersecurityNews — Nintendo Switch unauthorized code execution
- Cybernews — Nintendo Switch QR Code Flaw: Update Now
- GBHackers — Nintendo Switch QR Code Vulnerability
- SC Media — Nintendo patches critical Switch vulnerability
- Strix.ai — CVE-2026-82079 analysis
- VulDB — CVE-2026-82079 in Switch
What defenders are saying.
Crowdsourced verification outputs.
Results submitted by users who ran the verification payload against their environment.