Executive brief
Marlin is a popular open-source firmware used to control 3D printers. A security flaw in the way it handles bed leveling commands allows an attacker to send a specially crafted instruction that overwrites the printer's internal memory. This can lead to a complete device crash, erratic hardware behavior, or permanent corruption of the printer's settings, potentially disrupting manufacturing operations.
Technical details
An out-of-bounds write vulnerability exists in Marlin Firmware's M421 G-code handler within the Mesh Bed Leveling (MBL) implementation. The root cause is improper validation of the I and J array indices; while the code checked for negative values, it failed to verify the upper bounds against GRID_MAX_POINTS_X and GRID_MAX_POINTS_Y. An attacker can exploit this by sending a crafted M421 command via USB serial, a network interface, or a malicious G-code file. This allows the attacker to write a 32-bit float value to an arbitrary offset past the z_values array, leading to firmware state corruption or denial of service. The issue is fixed in commit 1f255d1.
Affected products
- MarlinFirmware Marlin through 2.1.2.7
Timeline
- 2026-06-23: disclosed: Issue reported and PR submitted to Marlin repository
- 2026-06-23: patched: Fix merged into Marlin bugfix-2.1.x branch
- 2026-06-24: advisory: CVE published and NVD record created