Summary

Components affected:

• Game software (Xenoblade Chronicles X: Definitive Edition) on Nintendo Switch

The vulnerability was fixed in the 1.0.2 version of the game, released globally on Apr 23, 2025.

Description

As part of its peer-to-peer protocol, the game allows peers in a mission to send RPC (remote procedure call) commands to each other. There were a couple issues with the implementation:

• Many RPCs would accept inputs that would later be used to index arrays, but in many cases those bounds were not checked, allowing an attacker to write arbitrary memory remotely.
• An unrestricted, and mostly unused, RPC would allow writing arbitrary flags to another player's save file (essentially editing their save file). This RPC would not restrict the range of allowed flags to those that the game exposes to multiplayer features in normal operation.

Impact

A malicious user with a modified console could:

• Write arbitrary flags in save files of other players in the same peer-to-peer mission (e.g. resetting their story progress), in a way that would not be immediately visible to the victim, potentially leading to the loss of a backup save.
• Cause denial of service to other users in the same peer-to-peer mission.

The attacker and the victim(s) would have to be in the same peer-to-peer online mission, connecting online or to the same group is not sufficient.