If you own an original Nintendo Switch, you should urgently update your system software to address a newly discovered security flaw. Nintendo disclosed the vulnerability (PDF) on September 10, following the release of its most recent 23.0.0 firmware version.
The vulnerability targets specific original Nintendo Switch users who utilize the Send to Smartphone function. When activated, this feature produces a QR code displayed on the device; users can then scan it with a mobile phone to send game captures or screenshots directly to their handheld.
Additionally, individuals navigating Super Mario Kart: Home Circuit via physical cartridges are vulnerable, as the game employs a QR code to synchronize wireless connections with adjacent players.
If another person scans your QR code prior to you, they gain access to your Switch via the connected device and could execute malicious code or extract personal account details from your console. Since your account information is stored on your Switch, that represents sensitive data you do not want to share with others.
A spokesperson for Nintendo declined to provide immediate additional commentary on the matter.
The affected vulnerability specifically impacts the original Nintendo Switch running firmware versions earlier than 23.0.0, leaving the upcoming Switch 2 untouched.
The solution involves updating to version 23.0.0, which was deployed on September 9 and resolves the issue. Officially cataloged as CVE-2026-82079—a stock-based buffer overflow allowing remote code execution—the flaw impacts original Switch units running firmware prior to 23.0.0.
To apply the necessary patch, navigate to System Settings, then select System, followed by System Update to initiate the installation process. Complete any forthcoming interface instructions to finalize the upgrade.
Nintendo advises users unable to update immediately to restrict Send to Smartphone usage to private environments, minimize public gameplay of Super Mario Kart: Home Circuit, and refrain from scanning QR codes with non-owned devices. Players who primarily engage with titles domestically remain unaffected and need not worry about this threat.
