{"id":"CVE-2026-82079","state":"PUBLISHED","title":"Potential Leakage of Nintendo Switch System Information Through a Proximity-Based Remote Attack","description":"A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wireless range to execute arbitrary code using return-oriented programming (ROP) through crafted network traffic.\nThis issue affects Nintendo Switch: before 23.0.0.","publishedAt":"2026-09-10T05:13:33.030Z","updatedAt":"2026-09-11T03:56:09.883Z","severity":{"score":7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","source":"Nintendo"},"assigner":"Nintendo","products":["Nintendo Nintendo Switch"],"affected":[{"vendor":"Nintendo","product":"Nintendo Switch","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.0.0","versionType":"custom"}]}],"references":["https://www.nintendo.com/security-advisories/en/index.html"],"weaknesses":["CWE-121"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82079.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82079","state":"PUBLISHED","datePublished":"2026-09-10T05:13:33.030Z","dateUpdated":"2026-09-11T03:56:09.883Z","assignerShortName":"Nintendo","assignerOrgId":"60e0823a-f1a8-4923-bd51-812de398c42c","dateReserved":"2026-08-28T00:46:53.480Z"},"containers":{"cna":{"title":"Potential Leakage of Nintendo Switch System Information Through a Proximity-Based Remote Attack","descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wireless range to execute arbitrary code using return-oriented programming (ROP) through crafted network traffic.\nThis issue affects Nintendo Switch: before 23.0.0."}],"affected":[{"vendor":"Nintendo","product":"Nintendo Switch","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.0.0","versionType":"custom"}]}],"references":[{"url":"https://www.nintendo.com/security-advisories/en/index.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","lang":"en","description":"CWE-121 Stack-based buffer overflow","type":"CWE"}]}],"providerMetadata":{"shortName":"Nintendo","orgId":"60e0823a-f1a8-4923-bd51-812de398c42c","dateUpdated":"2026-09-11T00:57:53.834Z"},"datePublic":"2026-09-10T05:00:00.000Z","impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"workarounds":[{"lang":"en","value":"If you cannot update to the latest system version right away, please note the following when using the system.\n\n\n\n\n\n  *  When using the \"Send to Smartphone\" feature in Album or when using a kart in Mario Kart Live: Home Circuit, please ensure that the QR code displayed on the console screen (or on the TV screen) cannot be viewed or scanned by third parties.\n  *  Please refrain from using the \"Send to Smartphone\" feature in Album with a smartphone other than your own, and from using a kart other than your own in Mario Kart Live: Home Circuit.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>If you cannot update to the latest system version right away, please note the following when using the system.</p><p></p><ul><li><span>When using the \"Send to Smartphone\" feature in Album or when using a kart in Mario Kart Live: Home Circuit, please ensure that the QR code displayed on the console screen (or on the TV screen) cannot be viewed or scanned by third parties.</span></li><li><span>Please refrain from using the \"Send to Smartphone\" feature in Album with a smartphone other than your own, and from using a kart other than your own in Mario Kart Live: Home Circuit.</span></li></ul><p></p>"}]}],"solutions":[{"lang":"en","value":"Perform System Update 23.0.0.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Perform System Update 23.0.0.</p>"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.4,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-09-10T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-82079"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-11T03:56:09.883Z"}}]}}}