Marlin Firmware EUVD-2026-38797

Exploitation requires the firmware to be built with MESH_BED_LEVELING enabled - without that compile-time option the vulnerable M421 handler is not present. The attacker must be able to deliver G-code to the printer through one of: a USB serial connection, an exposed network interface, or a crafted .gcode file the operator prints; per CVSS PR:N no authentication is required on the G-code channel and no user interaction is needed for the serial/network vectors (the malicious-file vector does require an operator to start the print). The decisive limiting factors are reachability of the G-code interface plus the non-default MESH_BED_LEVELING build, captured by AT:P (present attack requirement) in the vector; printers using other bed-leveling modes, or with no exposed serial/network/file ingestion, are not exploitable via this path.

Signals are largely consistent toward a real, prioritizable issue but bounded by deployment context. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VI:H/VA:H, score 8.3) reflects integrity and availability impact with no confidentiality loss and an attack requirement (AT:P) corresponding to the non-default MESH_BED_LEVELING build option. POC is publicly available and the fix is confirmed in commit 1f255d1, reported by VulnCheck. There is no EPSS score, no SSVC decision, and no KEV listing provided, so the probability of widespread automated exploitation is unquantified. The practical attack surface is narrow: most printers are reached over local USB serial, and the AV:N rating is only realistic for the subset exposed via a network interface (network-enabled boards or host gateways) or those that ingest untrusted .gcode files. Note the tension - the vector says AV:N but the most common real-world delivery is local serial or file-based, so for a typical USB-tethered hobby printer the effective vector is closer to local; verify exposure per deployment. Impact is corruption/DoS rather than confirmed remote code execution, though memory corruption on an MPU-less microcontroller could escalate to unpredictable physical machine behavior.

An attacker who can reach a network-exposed Marlin printer (or who tricks an operator into printing a malicious .gcode file) sends a single 'M421 I<large> J<large> Z<value>' command with grid indices beyond GRID_MAX_POINTS_X/Y. The handler writes the 32-bit float past z_values into adjacent firmware memory, corrupting state and crashing or destabilizing the controller. Given low complexity and publicly available POC, no chaining or special tooling is required once the G-code channel is reachable.