Nintendo Switch 2 Firmware 23.5.0 Breached in 4 Days: Researcher invokertr Demos New Exploit and Dumps Full European SDK
Kyoto's latest security perimeter lasted less than ninety-six hours. Just four days after Nintendo Switch 2 firmware 23.5.0 patching the ns2jb sandbox escape rolled out worldwide, a security researcher has demonstrated a brand-new working exploit running on the updated operating system alongside a full extraction of Nintendo's internal developer toolkit.
Video Proof on Firmware 23.5.0 and a 100% Complete European SDK Dump
Released on November 10 ahead of digital eShop game gifting for family groups, system update 23.5.0 was engineered to sever the core vulnerability behind the console's first software-only jailbreak. Created by security researcher Sammy Hajhamid (known online as Pepsipu) for firmware 23.0.1, the ns2jb exploit chained userland bugs inside backward-compatible titles like SmileBASIC 4 and the Switch 1 cartridge release of Sid Meier's Civilization VII with a filesystem buffer overflow to escape the game sandbox. As verified by dataminer OatmealDome following Nintendo's official Switch 2 system update 23.5.0 release notes, the patch locked down elevated filesystem privileges and halted retail cartridge dumping after the rapid extraction of the The Legend of Zelda: Ocarina of Time remake.
On November 14, security researcher invokertr (operating under the handle Sa†anic on X) shared video proof showing a new exploit executing directly on a Nintendo Switch 2 updated to firmware 23.5.0. Even more consequential for the platform's long-term security, the researcher claims to have secured a 100% complete software dump containing both the full 23.5.0 firmware package and the latest official European Software Development Kit (SDK).
Nintendo Switch 2
- 1080p HDR Handheld
- Switch 1 Backwards Compatibility
- Firmware 23.5.0
A Goldmine for Reverse Engineering Held Back Over HackerOne Payout Disputes
In the console reverse-engineering and emulation ecosystem, an updated official SDK dump carries far broader implications than a standalone userland bug. Partner development kits contain internal system libraries, compiler toolchains, hardware architecture documentation, and symbols that map out how the operating system communicates with the silicon. Combined with recent hardware discoveries such as engineer Michał Kopeć's 540-byte USB-C hub workaround for Switch 2 TV mode and early PC emulators like Lichii, access to the 23.5.0 European SDK gives researchers an exact blueprint of Nintendo's updated security layers.
Despite the breakthrough, Switch 2 owners who updated to 23.5.0 should not expect an immediate public jailbreak release. Addressing community questions on whether the files would be published open-source like ns2jb, invokertr stated that the exploit will remain private until there is a "serious fix for the HackerOne payouts," directly criticizing the reward structure of Nintendo's official bug bounty program on HackerOne.
By withholding the exploit chain over bounty compensation, the researcher highlights a recurring friction point between console manufacturers and independent vulnerability hunters. While Nintendo's HackerOne program officially offers rewards for critical Switch disclosures, researchers have frequently argued that its payout tiers lag behind industry standards for kernel-level and sandbox-escape flaws. For now, only consoles kept offline on firmware 23.0.1 can run public homebrew via ns2jb.
Check Availability for Switch 2 microSD Express Cards on Amazon→
My Perspective
Four days is all it took for firmware 23.5.0's clean sheet to crack in private, and honestly, the European SDK extraction is what should really keep Kyoto's security engineers awake this weekend. You can patch a sandbox escape in the next system update, but once a full developer SDK is dumped, its symbols and system call documentation inevitably accelerate reverse engineering and PC emulators like Lichii for years to come. What stands out to me most is the shift in leverage: while Pepsipu dropped ns2jb publicly for the sheer technical thrill, invokertr is openly holding this 23.5.0 chain hostage to call out Nintendo's notoriously stingy HackerOne bounty payouts. If you want top-tier security researchers to quietly file bug reports instead of flexing zero-day video proofs on X four days after a patch, you have to pay market rates for critical OS vulnerabilities.
Based on the outskirts of New York City, Chaya 'Chayane' spent five years studying software engineering in Montreal before returning to her home state. A Full-Stack developer and Deep Learning AI architecture researcher, she explores neural networks and algorithmic optimization while engineering data pipelines for Retrocharting and Gamescharting alongside Grimtag. A gamer for over 20 years and an avid collector of Nintendo history and The Legend of Zelda, she explored World of Warcraft's Azeroth before bringing her deep technical background to video game analysis.
