Uploaded September 2026 | Updated September 2026, 20 minutes ago
Arbitrary remote code execution in New Super Mario Bros. 2, delivered from another console in the same local wireless game.
Two array indices are taken straight off the wire from the other player, never bounds-checked, resulting in an arbitrary write.
The write forges a texture-copy command directly into the GPU command queue to gspwn a loader into executable memory. This then streams in the rest of the payload and jumps to it. No ROP. Will do a proper writeup at some point.
Arbitrary remote code execution in New Super Mario Bros. 2, delivered from another console in the same local wireless game.
Two array indices are taken straight off the wire from the other player, never bounds-checked, resulting in an arbitrary write.
The write forges a texture-copy command directly into the GPU command queue to gspwn a loader into executable memory. This then streams in the rest of the payload and jumps to it. No ROP. Will do a proper writeup at some point.
