Nintendo is warning about a security flaw in the first-gen Switch console related to the feature that lets you send game screenshots to a smartphone. It turns out you can hack the function to run malicious computer code or leak console data.
Nintendo has issued a security advisory about the vulnerability. It involves the Send to Smartphone function, which displays a QR code on the handheld that a smartphone can scan to initiate the wireless transfer of a game screenshot or in-game footage.
According to Nintendo, unnamed security researchers recently discovered a way to exploit QR codes to carry out a Proximity-Based Remote Attack. “If a third party can directly scan the QR code, they could run unauthorized code on your Nintendo Switch console or obtain information stored on the console,” the advisory says. The vulnerability can also be exploited with the displayed QR code when pairing the kart accessory to play Mario Kart Live: Home Circuit.
Details about the bug, dubbed CVE-2026-82079, are thin. But it involves a “stack-based buffer overflow,” where data copied into a memory buffer exceeds the buffer’s size, overwriting adjacent memory and potentially leading to software crashes or a path to hack the system.
Fortunately, exploiting the flaw isn’t easy since the hacker would need to be nearby. Nintendo also patched the issue last week with version 23.0.0. So, it’s recommended that users download and install the update. “You can check the current system version applied to your Nintendo Switch. From the HOME Menu, select System Settings > System. You can also update the system version,” the company says.
Recommended by Our Editors
Nintendo adds that “this vulnerability cannot be exploited to obtain console information on Nintendo Switch 2,” which seems to have phased out QR codes in favor of transferring screenshot via the Nintendo app.
About Our Expert
Michael Kan
Principal Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Click Here For The Original Source.
