From fca50b9678ae00e0859cb49a37f2385dc554624c Mon Sep 17 00:00:00 2001
From: Brian Popow <popow@gmx.de>
Date: Tue, 10 Mar 2026 16:44:44 +0100
Subject: [PATCH] Add check for enough data in ReadInternationalTextChunk()

---
 src/ImageSharp/Formats/Png/PngDecoderCore.cs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/ImageSharp/Formats/Png/PngDecoderCore.cs b/src/ImageSharp/Formats/Png/PngDecoderCore.cs
index 42480a30d1..eadd2a43ce 100644
--- a/src/ImageSharp/Formats/Png/PngDecoderCore.cs
+++ b/src/ImageSharp/Formats/Png/PngDecoderCore.cs
@@ -1937,6 +1937,11 @@ internal sealed class PngDecoderCore : ImageDecoderCore
             return;
         }
 
+        if (zeroIndexKeyword < 0 || zeroIndexKeyword + 4 > data.Length)
+        {
+            return; // Not enough data for keyword + null + flag + method + language.
+        }
+
         byte compressionFlag = data[zeroIndexKeyword + 1];
         if (compressionFlag is not (0 or 1))
         {