Azahar 2126.2: security flaw fixed, update your 3DS emulator
By Tgames · · 1 min read
Azahar 2126.2 fixes a serious flaw: a booby-trapped CIA file or 3DS homebrew could break out of the emulator and run code on your PC. Update now.
The flaw
The security advisory, rated high, was published on 8 October 2026 by the Azahar team, following a report from researchers at V12 Security. Two bugs in CIA file installation, combined, allowed a malicious file torun code on the computer (demonstrations exist on Windows and Linux). All versions from 2120 to 2126.1.2 are affected. 2126.2 fixes the problem.
Our advice: update, and do not install CIA files or homebrew of dubious origin. This applies to all emulators: a game downloaded from just anywhere may contain something other than a game.
The other fixes in 2126.2
The xBRZ filter works with Vulkan again, large eShop downloads now go through, and the debug servers (GDB, RPC) change how they work.
2127.0 alpha: Azahar on iPhone without JIT
On 10 October, a first alpha of 2127.0 replaced the old interpreter with a new one, FastInterp, which is much faster. On iPhone and Apple TV, where JIT is forbidden, games become playable down to the iPhone XS, sometimes at more than twice normal speed. It also fixes graphical effects (Shin Megami Tensei IV) and sound effects (New Super Mario Bros. 2). The project moves to the GPLv3 licence. It is an alpha: stick with 2126.2 for playing.
Our article on Azahar 2126.1 covers the previous new features.
Sources: Security advisory · Azahar 2126.2 · Azahar 2127.0 alpha 1
The flaw
The security advisory, rated high, was published on 8 October 2026 by the Azahar team, following a report from researchers at V12 Security. Two bugs in CIA file installation, combined, allowed a malicious file torun code on the computer (demonstrations exist on Windows and Linux). All versions from 2120 to 2126.1.2 are affected. 2126.2 fixes the problem.
Our advice: update, and do not install CIA files or homebrew of dubious origin. This applies to all emulators: a game downloaded from just anywhere may contain something other than a game.
The other fixes in 2126.2
The xBRZ filter works with Vulkan again, large eShop downloads now go through, and the debug servers (GDB, RPC) change how they work.
2127.0 alpha: Azahar on iPhone without JIT
On 10 October, a first alpha of 2127.0 replaced the old interpreter with a new one, FastInterp, which is much faster. On iPhone and Apple TV, where JIT is forbidden, games become playable down to the iPhone XS, sometimes at more than twice normal speed. It also fixes graphical effects (Shin Megami Tensei IV) and sound effects (New Super Mario Bros. 2). The project moves to the GPLv3 licence. It is an alpha: stick with 2126.2 for playing.
Our article on Azahar 2126.1 covers the previous new features.
Sources: Security advisory · Azahar 2126.2 · Azahar 2127.0 alpha 1
No comments