Researchers have discovered ns2jb, described as the first software-only, tethered jailbreak for the Nintendo Switch 2. According to documentation from the ns2jb repository, the exploit allows running arbitrary native code as system modules and provides access to Switch 2 peripherals through MMIO (memory-mapped I/O).
The jailbreak enables several capabilities: running homebrew software, reverse engineering and modifying Switch 2 games, backing up save files, and accessing most of the console’s hardware features. To demonstrate functionality, developers used the jailbreak to mod a Switch 2 exclusive title, Mario Kart World.
The technical approach involved multiple attack vectors. Researchers initially targeted WebKit, a popular target for console jailbreaks, exploiting a vulnerability loaded via a custom Wi-Fi captive portal to gain initial code execution. However, this approach proved limited for achieving deeper system access.
The team pivoted to SmileBASIC, a Switch 1 game previously exploited in past hacking efforts. Researchers discovered a 32-bit integer overflow vulnerability in SmileBASIC’s interpreter. When removing items from an array, the interpreter failed to properly validate that position plus count wouldn’t exceed array length, allowing integer wrapping. This flaw enabled out-of-bounds memory reads and writes.
From SmileBASIC, the researchers achieved return-oriented programming (ROP) execution. They then targeted the fs (filesystem) sysmodule—a built-in system service—by exploiting a buffer overflow in the GetEntryType command. The vulnerability involved path normalization that could overflow a 0x301-byte heap buffer when processing paths containing parent-directory components with backslashes.
By hijacking a BufferedStorage object’s cache pointer through this overflow, researchers gained arbitrary read/write access to memory. They modified their process identifier to spoof full filesystem permissions, allowing them to dump internal storage and sysmodule code for further analysis.
The jailbreak demonstrates a chain of escalating privileges from initial code execution through game exploitation to system-level access, revealing multiple security gaps across different layers of the Switch 2’s software architecture.
Key facts
- ns2jb is described as the first software-only, tethered jailbreak for Switch 2
- The exploit allows running arbitrary native code as system modules and accessing peripherals through MMIO
- Researchers exploited a 32-bit integer overflow in SmileBASIC’s array removal function
- A buffer overflow in the filesystem sysmodule’s path normalization was leveraged for arbitrary memory access
- The jailbreak enables homebrew, game modding, save file backup, and access to most console hardware