# [Xenoblade Chronicles X: Definitive Edition] Buffer overflow in string escape function, multiplayer DoS

Xenoblade Chronicles X escape function duplicated '\' and '%' without bounds-checking a 64-byte name buffer, letting crafted player names crash peers in online missions.

- Payout: hidden
- Severity: high
- Program: Nintendo
- Found by: roccodev
- Disclosed: 2025-05-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3048061
- Library page: https://bugbountylibrary.com/r/h1%3A3048061
- Tags: area:os domain:desktop impact:dos kind:bounty platform:hackerone sev:high technique:source-review vuln:dos vuln:memory-corruption

**Target:** Nintendo Switch game multiplayer name display
**Root cause:** The sanitization routine escapes '\' and '%' by duplicating them but never checks the destination buffer length, so a 64-byte name of all escapable chars doubles to 128 bytes and overflows the 64-byte buffer.
**Steps:**
1. Identify the 64-byte name tag buffer used in peer-to-peer online missions (other features use 32-byte buffers that stay safe).
2. Craft a player name of 64 escapable characters ('\' or '%') via a modified save or arbitrary data injection.
3. Join the same peer-to-peer online mission as the victim.
4. Game escapes each char to two bytes, writing 128 bytes into the 64-byte buffer, overflowing it and crashing the victim.
**How found:** Researcher noted the game escapes '\' and '%' by duplication and reasoned about buffer sizes, finding only the 64-byte name tag in peer-to-peer missions could receive a full 64-byte string while other features cap at 32 bytes.
**Exploitation:** Attacker with a modified save sets a 64-character name of '\'/'%' chars, then joins a peer-to-peer online mission with the victim; when the name tag is displayed the escape routine overflows the 64-byte buffer, causing DoS. Attacker and victim must be in the same mission.
**Insight:** When a sanitizer expands input (escaping/encoding), compute worst-case output length per input byte and check which call sites actually allow max-length attacker input; the dangerous sink is often the one feature with a larger buffer than the rest.