MarlinFirmware Marlin up to 2.1.2.7 Network Interface array index

Summaryinfo

A vulnerability marked as very critical has been reported in MarlinFirmware Marlin up to 2.1.2.7. Impacted is an unknown function of the component Network Interface Handler. This manipulation causes array index. The identification of this vulnerability is CVE-2026-56111. The attack needs to be done within the local network. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in MarlinFirmware Marlin up to 2.1.2.7 and classified as very critical. Affected by this vulnerability is an unknown code of the component Network Interface Handler. The manipulation with an unknown input leads to a array index vulnerability. The CWE definition for the vulnerability is CWE-129. The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_BED_LEVELING enabled, contains an out-of-bounds write vulnerability in the M421 G-code handler that allows attackers to corrupt firmware memory by supplying out-of-range X and Y grid indices. Attackers can send a single crafted G-code command via USB serial, network interface, or malicious gcode file to write an attacker-controlled 32-bit float value past the z_values array bounds, corrupting adjacent firmware variables and causing denial of service or firmware state corruption.

The weakness was shared by Christ Bouchuen as 28467. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-56111 since 06/18/2026. The exploitation appears to be easy. The attack needs to be initiated within the local network. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/24/2026).

Upgrading eliminates this vulnerability. Applying the patch 1f255d16ec2d456454fd444494cfb338d62b0fa1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firmware Software

Vendor

• MarlinFirmware

Name

• Marlin

Version

• 2.1.2.0
• 2.1.2.1
• 2.1.2.2
• 2.1.2.3
• 2.1.2.4
• 2.1.2.5
• 2.1.2.6
• 2.1.2.7

License

• open-source

Website

• Product: https://github.com/MarlinFirmware/Marlin/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion