CVE-2026-56111 is an out-of-bounds write vulnerability in Marlin Firmware through version 2.1.2.7. When the firmware is compiled with MESH_BED_LEVELING enabled, the M421 G-code handler does not properly validate array indices for X and Y grid coordinates. An attacker can exploit this by sending a crafted G-code command that writes a 32-bit float value beyond the z_values array boundary, corrupting adjacent firmware memory. This can cause denial of service or unpredictable firmware behavior. The vulnerability affects local interfaces including USB serial, network, or malicious G-code files. The issue is fixed in commit 1f255d1, but no official patch or advisory details are currently available.

Successful exploitation allows an unauthenticated attacker to corrupt firmware memory by writing out-of-bounds data. This can result in denial of service or corruption of the firmware state, potentially disrupting 3D printer operation or causing unpredictable behavior. The vulnerability is exploitable remotely via network interface or locally via USB serial or malicious G-code files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 1f255d1, so applying the corresponding update or firmware version beyond 2.1.2.7 is recommended once available. Until then, restrict access to interfaces that accept G-code commands (USB serial, network) to trusted users only to reduce risk.