Which versions of Marlin Firmware are affected by CVE-2026-56111?

Marlin 3D printer firmware versions through 2.1.2.7 with mesh-bed-leveling enabled are vulnerable to memory corruption via G-code commands, risking production downtime and equipment malfunction in…. A patch is available.

Is there a public PoC exploit available for CVE-2026-56111?

Yes, a public proof-of-concept exploit is available for CVE-2026-56111. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-56111?

Within 24 hours: Identify all 3D printers running Marlin Firmware through version 2.1.2.7 with MESH_BED_LEVELING enabled; disable external G-code submission if patches cannot be applied immediately. Within 7 days: Obtain and apply the vendor-released patch to all affected printers; test patched firmware in non-production environment before deployment to production systems. Within 30 days: Verify all Marlin Firmware instances are patched; implement access controls restricting G-code submission to authenticated, authorized systems only.

Marlin Firmware CVE-2026-56111

Q: What is the CVSS score of CVE-2026-56111?

CVE-2026-56111 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-38797 HIGH

Improper Validation of Array Index (CWE-129)

2026-06-24 VulnCheck

GHSA-x5qg-qgv8-q7cr

Denial Of Service Buffer Overflow Marlin

8.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

AC:H reflects the non-default MESH_BED_LEVELING build requirement; PR:N because G-code channels are typically unauthenticated; C:N as only integrity and availability are affected via memory corruption.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 24, 2026 - 15:51 vuln.today

Analysis Generated

Jun 24, 2026 - 15:51 vuln.today

DescriptionCVE.org

Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_BED_LEVELING enabled, contains an out-of-bounds write vulnerability in the M421 G-code handler that allows attackers to corrupt firmware memory by supplying out-of-range X and Y grid indices. Attackers can send a single crafted G-code command via USB serial, network interface, or malicious gcode file to write an attacker-controlled 32-bit float value past the z_values array bounds, corrupting adjacent firmware variables and causing denial of service or firmware state corruption.

AnalysisAI

Out-of-bounds write in Marlin Firmware (3D printer firmware) through 2.1.2.7 lets attackers corrupt firmware memory through the M421 G-code mesh-bed-leveling handler, which fails to upper-bound the X/Y grid indices before writing a 32-bit float into the z_values array. Any actor able to feed G-code to a printer built with MESH_BED_LEVELING enabled can write an attacker-controlled value past the array, overwriting adjacent firmware state and causing denial of service or unpredictable machine behavior. Publicly available exploit code exists and the fix is committed (1f255d1), but there is no public exploit identified as actively exploited in the wild (not in CISA KEV).

Technical ContextAI

Marlin is the dominant open-source firmware for 3D printers and other CNC/RepRap-style motion controllers, running on embedded microcontrollers (AVR/ARM) that typically lack memory protection. The flaw is a classic CWE-129 (improper validation of array index): the M421 command sets a mesh bed-leveling point via 'M421 I<x> J<y> Z<value>', and the handler only rejected negative indices (ix < 0 || iy < 0) without checking the upper bounds GRID_MAX_POINTS_X/Y. The patched code replaces this with WITHIN(ix, 0, GRID_MAX_POINTS_X - 1) and WITHIN(iy, 0, GRID_MAX_POINTS_Y - 1), enforcing both ends of the valid range. Because the write target is the fixed-size z_values mesh array, an out-of-range index lets the supplied float land in adjacent firmware variables in RAM. This code path only compiles when MESH_BED_LEVELING is enabled (distinct from the more common AUTO_BED_LEVELING_BILINEAR/UBL paths), consistent with cpe:2.3:a:marlinfirmware:marlin.

RemediationAI

Upstream fix available (PR/commit); a released patched version is not independently confirmed beyond commit 1f255d1, so update to a Marlin build that includes commit 1f255d16ec2d456454fd444494cfb338d62b0fa1 (PR #28468) - i.e., rebuild and reflash from current main or any release tagged after 2.1.2.7 that contains it. If you cannot reflash immediately, the most effective compensating control is to rebuild without MESH_BED_LEVELING (switching to a different leveling mode such as bilinear/UBL) to remove the vulnerable M421 path entirely, accepting the trade-off of losing manual mesh bed leveling. For network-exposed printers, restrict access to the serial/network G-code interface to trusted hosts only and place the printer behind a host controller on an isolated VLAN, which blocks the remote AV:N path but does not stop a locally tethered operator. Finally, do not load untrusted or third-party .gcode files, since a malicious file can carry the crafted M421 command. Reference the VulnCheck advisory (https://www.vulncheck.com/advisories/marlin-firmware-out-of-bounds-write-via-m421-g-code-handler) and issue #28467.