On October 22, 2026, developer Sammy Hajhamid, known as pepsipu, publicly announced ns2jb, a software-only, tethered jailbreak for Nintendo Switch 2. He said it can run native code with ordinary system-module permissions on firmware 23.0.1, but does not provide kernel access or survive a restart. His announcement also described modified characters in Mario Kart World.
What ns2jb reportedly does
Pepsipu describes ns2jb as reaching the built-in fs system module and allowing native code to run with the permissions of ordinary system modules. That is access to privileged system software, not the kernel, the core of the operating system. He identifies Nintendo Switch 2 firmware 23.0.1 as the target.
The public demonstration centered on Mario Kart World. Pepsipu said he had added characters including Cinnamoroll, Peter Griffin and Hatsune Miku. The technical post describing the exploit is dated October 18, 2026; his public announcement is dated October 22.
The exploit chain in pepsipu’s account
Pepsipu describes two bugs leading to the reported access. In SmileBASIC’s interpreter, a 32-bit position + count calculation during array removal can wrap to a negative value, causing an out-of-bounds memory operation. A separate path-normalization bug in fs overflows a temporary 0x301-byte buffer, which he says provides arbitrary reading and writing within that process.
He describes using that process-level access to reach code execution with ordinary system-module permissions. The distinction matters: the claimed chain reaches system modules, while pepsipu says it stops short of kernel access.
What happens after a restart
ns2jb is tethered, meaning its payload does not persist in memory after the console restarts, according to pepsipu. The affected processes return to their normal state. He also says the jailbreak does not provide persistent custom firmware.
The announcement does not mean a Switch 2 emulator or native PC ports are ready. Pepsipu describes emulation as a possible future direction; the demonstrated result was modified Mario Kart World gameplay.
What pepsipu says Codex contributed
Pepsipu credits Codex with helping research vulnerabilities, but says an initial automated attempt to reach userland code execution did not succeed. He described the jailbreak work as requiring substantial effort over about two weeks. The Mario Kart World modification was a separate project that he said took one day.
