[3DS][SSL] Improper certificate validation allows an attacker to perform MitM attacks #894922 Valid Cryptography – 2020-12-18 – 129 ASLR leak in Mario Kart World through LAN mode #3463719 Valid Information Disclosure High 2026-02-19 – 74 [Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotely #3062122 Valid Injection and Smuggling Critical 2025-05-15 – 65 Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer Submission #3559522 Valid Input Validation and Logic High 2026-07-02 – 62 Splatoon 3 Anticheat Seed Randomization Weakness #3042475 Valid Cryptography – 2026-02-19 – 55 Man-in-the-middle through broken SSL certificate verification #3174987 Valid Cryptography Medium 2025-08-08 – 53 [3DS][SSL][SDK] Unchecked number of audio channels in Mobiclip SDK leads to RCE in eShop movie player #897606 Valid Memory Corruption – 2020-12-18 – 43 [Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE #2551512 Duplicate Memory Corruption Low 2026-08-07 – 42 [Xenoblade Chronicles X: Definitive Edition] Improper validation of names allows injecting formatting tags and bypassing profanity filter #3052880 Valid No weakness recorded Medium 2025-05-15 – 40 Arbitrary code execution in TSEC Heavy Secure, return-oriented programming in TSEC Secure ROM, and recovery of TSEC-derived cryptographic secrets #924418 Valid Access Control Medium 2024-07-22 – 38 [3DS][SSL] Use of uninitialized class member leads to RCE in eShop movie player #895769 Valid Memory Corruption – 2020-12-18 – 38 [Splatoon 3] Kick other players with NplnLogin message #3813932 Valid Access Control Medium 2026-07-02 – 37 [Switch, PIA/MK8DX] Stack buffer overflow and potential RCE in PIA (LAN/LDN, possibly NEX) room info deserialization #2611669 Valid Memory Corruption Medium 2024-09-30 – 36 [MK8DX] Improper ranking/replay file parsing #1813453 Valid Memory Corruption Critical 2025-07-06 – 36 [Switch] Remote stack buffer overflow in the LDN/LP2P DHCP server leads to control-flow hijack #3770768 Valid Memory Corruption High 2026-10-15 – 35 [3DS][StreetPass] Heap Overflow in Swapnote parser leads to userland StreetPass RCE #923240 Valid Memory Corruption – 2021-01-18 – 30 [3DS][StreetPass] Buffer Overflow in Super Mario Maker level decompression #687887 Valid Memory Corruption – 2021-04-20 – 30 [MK8DX] Improper verification of Competition creation allows to create "Official" competitions #1653676 Valid Access Control – 2022-12-15 – 23 NEX: Stack overflow in UnicodeToUtf8 #469997 Not checked yet Memory Corruption – – – 23