Prusa: security updates for PrusaSlicer 2.9.7 and firmware 7.0.0, update recommended

Prusa has released two updates with security fixes within a few days. Anyone using a Prusa printer or PrusaSlicer should install both.

PrusaSlicer 2.9.7

PrusaSlicer 2.9.7 came out on 2 November 2026. Prusa describes it as a small maintenance release that fixes several security vulnerabilities:

• an out-of-bounds write when loading 3MF files with a malformed bed index
• a buffer overflow in the digits() and zdigits() placeholders
• several issues in the Printables downloader
• exploitable vulnerabilities in the libbgcode library when loading corrupted binary G-code files

According to Prusa, a security researcher reported the issues through its responsible disclosure programme. The update matters most for anyone who opens 3MF or G-code files from the internet.

Firmware 7.0.0

On 29 October, Prusa had already released firmware 7.0.0 for the CORE One and CORE One+. Prusa explicitly states that it includes a security update and plans to publish the source code and details in the coming weeks. The update of 7 November below explains which vulnerabilities are involved.

Firmware 7.0.0 also adds support for the HT hotend with automatic detection, filament profiles for PPS and PPA, automatic Z alignment on uneven beds, tool mapping presets and a configurable filament runout reaction. Whether and when security updates arrive for other Prusa printers is listed on Prusa’s download pages for each model.

Update 5 November 2026: firmware 8.0.0 for all current printers

On 3 November, Prusa released firmware 8.0.0. According to Prusa, it includes the security fixes from 7.0.0 and covers the CORE One L+ and L, CORE One+ and CORE One (each also INDX), XL+ and XL, MK4S and MK4, MK3.9S and MK3.9, MK3.5S and MK3.5, and MINI+ and MINI. New features include:

• OpenPrintTag: the CORE One and CORE One L read filament data from NFC-tagged spools, which needs a compatible reader. Usage is written back to the tag. This does not yet work on the CORE One INDX.
• Filament acceleration limit (M204 F), 120 mm/s² by default, 50 mm/s² on the MINI
• Flexible filament loads, unloads and purges about three times faster than before
• Prusa Connect connects faster and more reliably, on the MK4 in about 2.4 instead of 11 seconds when idle

Update 7 November 2026: details of the vulnerabilities

It is now known what the issues are. Security researcher Yannick Dixken examined an MK4S in August and reported 14 findings with around 23 individual defects to Prusa. He published the details on 2 November, coordinated with Prusa.

• Most severe (score 8.1 out of 10): via the Prusa Connect link, an overlong file path allows code execution on the printer. This requires an attacker who controls the Connect server or sits in the middle of the network connection.
• Other issues: another machine on the network can stall the printer’s networking without authentication. There are also bugs with encrypted G-code files, USB stick access and the MMU code.
• Affected: CORE One L+ and L, CORE One+ and CORE One (each also INDX), XL+ and XL, MK4S and MK4, MK3.9S and MK3.9, MK3.5S and MK3.5, and MINI
• Fixed: from firmware 7.0.0; the current version is 8.0.0

According to Prusa, no real-world attack is known. Anyone running one of these printers on a network should still update to the current firmware.