CVEvulnerability

CVE-2022-47949

9.8 CRITICAL Published 2022-12-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-120

Description

The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. The victim must join a game session with the attacker. Other affected products include Mario Kart 7 before 1.2, Mario Kart 8, Mario Kart 8 Deluxe before 2.1.0, ARMS before 5.4.1, Splatoon, Splatoon 2 before 5.5.1, Splatoon 3 before late 2022, Super Mario Maker 2 before 3.0.2, and Nintendo Switch Sports before late 2022.

Affected configurations

• nintendo animal crossing\ new horizons (< 2.0.6) • nintendo arms (< 5.4.1) • nintendo mario kart 7 (< 1.2) • nintendo mario kart 8 (< 2.1.0) • nintendo mario kart 8 • nintendo splatoon • nintendo splatoon 2 (< 5.5.1) • nintendo splatoon 3 • nintendo super mario maker 2 (< 3.0.2) • nintendo switch sports

Related

Weakness · CWE (1)

  • CWE-120 Buffer Copy without Checking Size of Input weakness

References