Nintendo Program Statistics

View program

23 total issues disclosed

$14,906 total paid publicly

Most disclosed (3 disclosures) — Heap Overflow

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
[Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE Stack Overflow jonbarrow Low 2026-08-07
Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer Submission Client-Side Enforcement of Server-Side Security hana2736 High 2026-07-02
[Splatoon 3] Kick other players with NplnLogin message Improper Access Control - Generic alzxk11 Medium 2026-07-02
Splatoon 3 Anticheat Seed Randomization Weakness Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) hana2736 No rating 2026-02-19
ASLR leak in Mario Kart World through LAN mode Information Disclosure kinnay High 2026-02-19
Man-in-the-middle through broken SSL certificate verification Man-in-the-Middle kinnay Medium 2025-08-08
[MK8DX] Improper ranking/replay file parsing Memory Corruption - Generic crazy_man123 Critical 2025-07-06
NEX: Stack overflow in UnicodeToUtf8 Stack Overflow kinnay None 2025-06-27
[Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotely Resource Injection roccodev Critical 2025-05-15
[Xenoblade Chronicles X: Definitive Edition] Improper validation of names allows injecting formatting tags and bypassing profanity filter None supplied roccodev Medium 2025-05-15
[Xenoblade Chronicles X: Definitive Edition] Buffer overflow in string escape function, multiplayer DoS Classic Buffer Overflow roccodev High 2025-05-15
[Switch, PIA/MK8DX] Stack buffer overflow and potential RCE in PIA (LAN/LDN, possibly NEX) room info deserialization Stack Overflow jitlua Medium 2024-09-30
Arbitrary code execution in TSEC Heavy Secure, return-oriented programming in TSEC Secure ROM, and recovery of TSEC-derived cryptographic secrets Privilege Escalation lnchan Medium 2024-07-22
[WiiU/Switch] nullptr dereference in the ENL framework NULL Pointer Dereference crazy_man123 High 2023-08-22
[MK8DX] Improper metadata validation 2 Array Index Underflow crazy_man123 High 2023-08-17
[MK8DX] Improper metadata parsing NULL Pointer Dereference crazy_man123 Critical 2023-08-17
[WiiU/Switch] Remote code execution inside the ENL library Classic Buffer Overflow crazy_man123 High 2023-08-11
[MK8DX] Improper verification of Competition creation allows to create "Official" competitions Improper Access Control - Generic crazy_man123 High 2022-12-15
[3DS][StreetPass] Buffer Overflow in Super Mario Maker level decompression Heap Overflow mrnbayoh Critical 2021-04-20
[3DS][StreetPass] Heap Overflow in Swapnote parser leads to userland StreetPass RCE Heap Overflow mrnbayoh None 2021-01-18
[3DS][SSL] Improper certificate validation allows an attacker to perform MitM attacks Improper Certificate Validation mrnbayoh Critical 2020-12-18
[3DS][SSL][SDK] Unchecked number of audio channels in Mobiclip SDK leads to RCE in eShop movie player Heap Overflow mrnbayoh None 2020-12-18
[3DS][SSL] Use of uninitialized class member leads to RCE in eShop movie player Use After Free mrnbayoh None 2020-12-18