diff --git a/esphome/components/bluetooth_proxy/bluetooth_connection.cpp b/esphome/components/bluetooth_proxy/bluetooth_connection.cpp
index 7ba9e61e190..9820977a134 100644
--- a/esphome/components/bluetooth_proxy/bluetooth_connection.cpp
+++ b/esphome/components/bluetooth_proxy/bluetooth_connection.cpp
@@ -245,7 +245,9 @@ void BluetoothConnection::send_service_for_discovery_() {
       service_resp.characteristics.init(total_char_count);
       uint16_t char_offset = 0;
       esp_gattc_char_elem_t char_result;
-      while (true) {  // characteristics
+      // Bound by total_char_count: the vector is sized for it, and a malicious peripheral
+      // can make enumeration return more entries than the count query reported
+      while (char_offset < total_char_count) {  // characteristics
         uint16_t char_count = 1;
         esp_gatt_status_t char_status =
             esp_ble_gattc_get_all_char(this->gattc_if_, this->conn_id_, service_result.start_handle,
@@ -287,7 +289,7 @@ void BluetoothConnection::send_service_for_discovery_() {
         characteristic_resp.descriptors.init(total_desc_count);
         uint16_t desc_offset = 0;
         esp_gattc_descr_elem_t desc_result;
-        while (true) {  // descriptors
+        while (desc_offset < total_desc_count) {  // descriptors
           uint16_t desc_count = 1;
           esp_gatt_status_t desc_status = esp_ble_gattc_get_all_descr(
               this->gattc_if_, this->conn_id_, char_result.char_handle, &desc_result, &desc_count, desc_offset);