Switch 2 Software Exploit Runs Mario Kart World Mods, but Resets After Reboot

A programming app opens a route into Switch 2

Security researcher Sammy Hajhamid, known online as pepsipu, has demonstrated a software exploit for Nintendo Switch 2 running firmware 23.0.1, using modified Mario Kart World races to show what the access allows. Characters including Cinnamoroll, Hatsune Miku and Peter Griffin appeared in the game without a hardware modchip being installed.

The tool, called ns2jb, combines a weakness in an original Switch programming app with a vulnerability in the console's filesystem service. Hajhamid says it allows native code execution with the permissions of several system services, opening possibilities for unofficial applications, game modifications and copying saved games off the console.

The central limitation is straightforward: the access disappears when the console restarts. Users must trigger the exploit again after each reboot, and it does not currently provide persistent custom firmware, an alternative version of the console's system software that stays installed.

Hajhamid's technical account is dated October 18, 2026, while his public demonstration appeared on October 22. He identified 23.0.1 as the latest firmware at the time. The research reportedly took roughly two weeks and involved OpenAI's Codex coding tool, alongside substantial work by the developer.

Nintendo had not publicly commented at the time of the accounts describing the demonstration. SmileBASIC 4, the programming app used as the entry point, was reportedly removed from some regional eShops, making access to the required software an immediate concern for people hoping to investigate the exploit.

What the Mario Kart demonstration shows

Mario Kart World supplied the most visible result: familiar racers were joined by characters from outside Nintendo's game. The demonstrations included Cinnamoroll, Hatsune Miku, Peter Griffin and RED, the red Angry Bird. Steve from Minecraft also appeared in descriptions of the modified game.

The more consequential change happens beneath the race. Native code execution means running instructions directly on the console's processor, rather than staying within the commands that a game or programming app normally permits. The permissions attached to that code determine which parts of the machine it can reach.

Hajhamid, a security researcher identified as a Caltech undergraduate, described the intended uses of that access:

This lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2's peripherals through MMIO.

Homebrew means unofficial software made outside the console maker's approved distribution system. Reverse engineering means examining how existing software works. MMIO, short for memory mapped input/output, is a way for software to communicate with hardware through designated memory addresses.

Those capabilities matter to different groups for different reasons. A player might want an independent copy of a save file, a modder might want to replace a character, and a researcher might want to inspect a system service. Each depends on access that ordinary games do not normally receive.

How an older Switch app becomes the entry point

SmileBASIC 4 lets users write and run programs on the original Nintendo Switch. Switch 2 can run that software through backward compatibility, the feature that allows games from an earlier console to work on its successor. That connection gave Hajhamid a route into the newer machine through older software.

The first weakness involved an integer overflow in the SmileBASIC interpreter, the component that reads and carries out programming commands. An integer overflow happens when a calculation exceeds the range a computer has reserved for a number, causing the result to wrap around to another value.

In this case, a calculation used to check an operation on an array, a list of stored values, could wrap into a negative number. The check then accepted an operation that should have been rejected. A later memory copy moved data outside the intended area.

Hajhamid described using that behavior to make the program treat part of an array as a string. That confusion created a way to read and change memory beyond the program's intended boundaries. The initial research could be carried out on an original Switch before being used as part of the Switch 2 chain.

SmileBASIC had previously been involved in homebrew exploits on Nintendo's 3DS. Here, its particular value was that an older app could supply the first stage of an attack against a newer console.

A second flaw reaches the filesystem service

Access inside SmileBASIC was only the beginning. Hajhamid then targeted the built in filesystem service, known as fs, which handles storage operations. Reaching a service with broader permissions was necessary to move beyond the restrictions of the programming app.

The second vulnerability concerned path normalization. A file path tells software where to find something in storage; normalization tidies that path into a standard form before the system uses it. Hajhamid described a case in which the service copied a path into a temporary buffer that was too small.

A buffer is a reserved area of memory. When data spills beyond its boundary, it can overwrite nearby information. Hajhamid used that overflow to affect a storage cache object, creating a way to read and write memory in the filesystem service.

He then described changing the process identity recorded for SmileBASIC's connection, obtaining broader filesystem permissions. That allowed him to copy internal storage and the code of ordinary system modules for examination. System modules, or sysmodules, are services that perform jobs for the operating system.

The resulting ns2jb capabilities include running native code as ordinary system modules and as the built in filesystem module, according to Hajhamid. The chain therefore has two distinct stages: an initial opening through SmileBASIC and a second vulnerability that grants wider access.

Codex helped, but the work took two weeks

Hajhamid used OpenAI's Codex during the research, with a custom setup that let AI agents send controller inputs to consoles and inspect their video output. JetKVM devices connected controller input over USB and captured video over HDMI.

A Bluetooth light switch mechanism supplied an unusual but practical part of the setup: it physically pressed the console's power button after a crash. Repeated crashes are a routine possibility during this kind of memory research, so restarting the hardware was part of the testing process.

Codex found the useful integer overflow in SmileBASIC, according to Hajhamid's account. The work also involved investigating system services, examining code and developing the chain that reached the filesystem service. Hajhamid personally described investigating that service while AI agents explored other targets.

The developer clarified that a joking caption about simply telling an AI to jailbreak the console was not the actual process. An initial goal of obtaining code execution through another route did not succeed, and the jailbreak required substantial effort over roughly two weeks.

Hajhamid said Codex produced the Mario Kart World modification in a day. That places the playful demonstration on a different timescale from the security research behind it: the visible character changes came after the harder work of gaining access.

Why the browser route was abandoned

WebKit, the browser engine used in the initial attempt, was an early target because browsers process complex content and have often attracted security research. Hajhamid's setup explored reaching it through a custom Wi-Fi captive portal, the kind of page that can appear when a device joins a network.

The approach ran into several protections. Execute only memory restricts reading executable instructions, making useful code sequences harder to locate. Pointer authentication checks certain addresses before they are used, while control flow integrity checks whether some transfers of execution follow permitted paths.

The initial browser work reached a narrower form of control but did not produce the arbitrary communication with system services needed for the intended jailbreak. Hajhamid consequently pursued the SmileBASIC route while browser research continued separately.

He identified adapting the filesystem exploit to WebKit as a possible direction for further work. That could provide a different entry point, although no release date was given for such a version. He also said the exploit had been tested on the original Switch but had not yet been packaged for that console.

What users would need, and what resets

The described route uses SmileBASIC 4 version 4.4.9, with a reported US eShop price of about $25. Another modder said the title might not be strictly necessary, but the demonstrated chain begins with the programming app. The practical requirements for any alternative route remain unsettled.

A free Japanese trial also drew attention as people looked for ways to obtain the software. It was reportedly incompatible with the exploit. The trial and the paid version therefore have different reported usefulness for this particular method.

Ns2jb is described as tethered. In this case, that means the exploit must be launched again from a game after each console start. Restarting clears the active exploit from memory and returns the affected processes to their normal state.

A software exploit and persistent custom firmware provide different kinds of access. Ns2jb changes what can run during an active session. Persistent custom firmware would require a further mechanism that continues to work across restarts.

The current instructions are also described as difficult for an average player to follow. The immediate audience is therefore researchers and technically experienced modders, rather than every owner who wants a simple menu for installing unofficial applications.

Nintendo's response and the release timeline

SmileBASIC 4's availability became a concern soon after the demonstration. Some users reportedly bought the app and disconnected their consoles from the internet because they feared an update would close the opening. Accounts published around the announcement described either an expected removal or the app already disappearing from some regional stores.

Nintendo had not issued an official explanation or announced a patch in those accounts. The extent of the reported store removals, including which regions were affected, was not confirmed. Removing an app from sale would limit new purchases; a system or software update would address the vulnerable code through a different route.

The dates described in the announcement and technical account are:

• October 18, 2026: Hajhamid's technical account was dated, identifying ns2jb as a software exploit for firmware 23.0.1.
• October 22, 2026: Hajhamid publicly shared the Mario Kart World demonstration and announced the jailbreak.
• Around the October 22 announcement: users discussed buying SmileBASIC 4, while accounts described possible or completed removals from regional eShops.

Developer Geziné, who had disclosed a separate vulnerability affecting both Switch generations, said they had spoken with pepsipu and that the tool appeared legitimate. Geziné also said pepsipu knew about a separate user mode exploit they had developed.

Hajhamid described ns2jb as the first Switch 2 exploit of its kind to his knowledge. Its immediate contribution is a working route for deeper software research and game modification, with clear limits on persistence and ease of use.

Key Points

• Ns2jb reportedly works on Switch 2 firmware 23.0.1 without a hardware modchip.
• The demonstrated chain combines a SmileBASIC memory flaw with a vulnerability in the filesystem service.
• Sammy Hajhamid, known as pepsipu, used OpenAI's Codex during roughly two weeks of research.
• Mario Kart World demonstrations featured custom characters including Cinnamoroll, Hatsune Miku and Peter Griffin.
• The exploit disappears after a restart and does not currently provide persistent custom firmware.
• The described entry point uses SmileBASIC 4 version 4.4.9; regional store removals were reported, while Nintendo had not publicly commented.