CVE-2026-56111 is an out-of-bounds write vulnerability in Marlin Firmware through version 2.1.2.7, specifically in the M421 G-code handler when built with MESH_BED_LEVELING enabled. The vulnerability arises from improper validation of array indices for X and Y grid coordinates, allowing an attacker to write a 32-bit float value beyond the z_values array bounds. This memory corruption can affect adjacent firmware variables, leading to denial of service or corruption of the firmware state. The vulnerability can be triggered remotely by sending a crafted G-code command via USB serial, network interface, or a malicious G-code file. The issue was fixed in commit 1f255d1, but no official patch or vendor advisory is provided in the data.

Successful exploitation allows an unauthenticated attacker to corrupt firmware memory by writing out-of-bounds data, potentially causing denial of service or unpredictable firmware behavior. This can disrupt 3D printer operation or cause persistent firmware state corruption, impacting device reliability and safety.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in commit 1f255d1, so upgrading to a version including this fix is recommended once available. Until then, avoid enabling MESH_BED_LEVELING if possible or restrict access to interfaces that accept G-code commands from untrusted sources.