CVE-2026-56111

Name of the Vulnerable Software and Affected Versions Marlin Firmware versions prior to commit 1f255d1

Description An out-of-bounds write issue exists in the M421 G-code handler when the software is built with MESH BED LEVELING enabled. An attacker can corrupt firmware memory by providing out-of-range X and Y grid indices through a crafted G-code command sent via USB serial, network interface, or a malicious gcode file. This allows a 32-bit float value to be written past the z values array bounds, which can lead to the corruption of adjacent firmware variables, resulting in firmware state corruption or denial of service.

Recommendations Update Marlin Firmware to the version containing commit 1f255d1. As a temporary mitigation, disable the MESH BED LEVELING feature during the build process.