Nintendo Discloses Switch Security Flaw Exploitable via QR Code Scanning

Nintendo released a security notice on September 11, 2026, disclosing a security vulnerability affecting Switch consoles. The flaw can be exploited by a third party through a close-range remote attack to run unauthorized code on a user's console or obtain some information stored on the console. The attack requires the third party to directly scan a QR code displayed on the Switch console screen or a TV screen, and the QR code must appear when using the album's "Send to Smartphone" feature or when using a kart to play Mario Kart Live: Home Circuit. Users are not affected if the QR code is not scanned.

Nintendo confirmed that affected consoles are Switch systems running system firmware versions below 23.0.0, and that the vulnerability cannot be used to obtain console information on Nintendo Switch 2. Nintendo had previously released a major 23.0.0 update for Nintendo Switch 2 that added multiple features. The notice lists measures including updating the console to the latest system version, 23.0.0, and explains that the current system version can be checked from the HOME menu by selecting "System Settings" > "System," where the update can also be performed. For situations where an immediate update is not possible, the notice also states that when using the album's "Send to Smartphone" feature or using a kart to play Mario Kart Live: Home Circuit, the QR code scanning environment and whether the smartphone or kart used belongs to the user are relevant to the risk.