CVE-2022-47949
Critical
Description
The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. The victim must join a game session with the attacker. Other affected products include Mario Kart 7 before 1.2, Mario Kart 8, Mario Kart 8 Deluxe before 2.1.0, ARMS before 5.4.1, Splatoon, Splatoon 2 before 5.5.1, Splatoon 3 before late 2022, Super Mario Maker 2 before 3.0.2, and Nintendo Switch Sports before late 2022.
SeverityCritical
CVSS9.8
Exploit probability—
ProductNintendo Animal Crossing\
PublishedDec 24, 2022
First seenDec 24, 2022
Weakness typeCWE-120CWE-120
How to fix
Update
- nintendo animal_crossing\2.0.6 or later
- nintendo arms5.4.1 or later
- nintendo mario_kart_71.2 or later
- nintendo mario_kart_82.1.0 or later
- nintendo splatoon_25.5.1 or later
- nintendo super_mario_maker_23.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nintendo animal_crossing\ | _new_horizons ≤ v < 2.0.6 | 2.0.6 |
| nintendo arms | v < 5.4.1 | 5.4.1 |
| nintendo mario_kart_7 | v < 1.2 | 1.2 |
| nintendo mario_kart_8 | v < 2.1.0, No range specified | 2.1.0 |
| nintendo splatoon | No range specified | — |
| nintendo splatoon_2 | v < 5.5.1 | 5.5.1 |
| nintendo splatoon_3 | No range specified | — |
| nintendo super_mario_maker_2 | v < 3.0.2 | 3.0.2 |
| nintendo switch_sports | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.