CVE Intelligence
Analysis AI-assisted

CVE-2026-56111: Marlin Firmware M421 G-code Out-of-Bounds Write

Marlin Firmware through 2.1.2.7 contains an out-of-bounds write in the M421 G-code handler when MESH_BED_LEVELING is enabled. The record links the flaw to CWE-129, a CVSS 3.1 score of 9.1, and a fix in commit 1f255d1. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Marlin Firmware through 2.1.2.7 contains an out-of-bounds write in the M421 G-code handler when built with MESH_BED_LEVELING enabled. The flaw is classified as CWE-129 (improper validation of an array index). According to the record, the issue was fixed in commit 1f255d1.

Impact

  • Out-of-range grid indices can cause a value to be written beyond the bounds of the z_values array.
  • The record states this may corrupt adjacent firmware variables, leading to denial of service or firmware state corruption.
  • VulnCheck lists a CVSS 3.1 base score of 9.1 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The record also lists a CVSS 4.0 score of 8.3.

Affected products and versions

  • Marlin Firmware through 2.1.2.7, as stated in the record.
  • Only builds with MESH_BED_LEVELING enabled are described as affected.
  • The record contains no structured affected or fixed version data, so the first release containing the fix is unknown.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update to a Marlin Firmware build that includes commit 1f255d1 or later, and check the release notes to identify the release that contains it.
  • If an update cannot be applied immediately, restrict who can send G-code to the printer through USB serial, network interfaces and file-based jobs, and review untrusted gcode files before running them.
  • Disable MESH_BED_LEVELING only if it is not required, recognizing that this changes printer functionality.

Detection guidance

  • Review controller logs and host software for unexpected M421 commands or unusual mesh values.
  • Monitor for unexpected resets, crashes or abnormal bed-leveling behavior, which may indicate memory corruption.

Limitations of the available information

  • The record does not list a fixed release version.
  • No EPSS score or SSVC decision is available.
  • The sources reviewed do not describe the memory layout or exploitability conditions, and this analysis does not cover them.

Frequently asked questions

Which Marlin versions are described as affected?

The record describes Marlin Firmware through 2.1.2.7 as affected when built with MESH_BED_LEVELING enabled. It does not provide structured version data, so check the release notes of your build.

Is this vulnerability known to be exploited in the wild?

The record shows this CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.