diff --git a/src/common/imagbmp.cpp b/src/common/imagbmp.cpp
index 0ae3dfdde2..df3b52c0cd 100644
--- a/src/common/imagbmp.cpp
+++ b/src/common/imagbmp.cpp
@@ -873,6 +873,8 @@ bool LoadBMPData(wxImage * image, const BMPDesc& desc,
                                     aByte = stream.GetC();
                                     if ( !stream.IsOk() )
                                         return false;
+                                    if ( aByte >= ncolors )
+                                        return false;
                                     ptr[poffset    ] = cmap[aByte].r;
                                     ptr[poffset + 1] = cmap[aByte].g;
                                     ptr[poffset + 2] = cmap[aByte].b;
@@ -889,6 +891,8 @@ bool LoadBMPData(wxImage * image, const BMPDesc& desc,
                         else
                         {
                             // encoded mode (repeat aByte first times)
+                            if ( aByte >= ncolors )
+                                return false;
                             for ( int l = 0; l < first && column < width; l++ )
                             {
                                 ptr[poffset    ] = cmap[aByte].r;
@@ -900,6 +904,8 @@ bool LoadBMPData(wxImage * image, const BMPDesc& desc,
                     }
                     else
                     {
+                        if ( aByte >= ncolors )
+                            return false;
                         ptr[poffset    ] = cmap[aByte].r;
                         ptr[poffset + 1] = cmap[aByte].g;
                         ptr[poffset + 2] = cmap[aByte].b;
diff --git a/tests/image/image.cpp b/tests/image/image.cpp
index 50336c838d..1b6cb4f66b 100644
--- a/tests/image/image.cpp
+++ b/tests/image/image.cpp
@@ -1678,6 +1678,26 @@ TEST_CASE_METHOD(ImageHandlersInit, "wxImage::BMP", "[image][bmp]")
         LoadMalformedImage("image/badrle4.bmp", wxBITMAP_TYPE_BMP);
         LoadMalformedImage("image/width-times-height-overflow.bmp", wxBITMAP_TYPE_BMP);
     }
+    SECTION("8bpp colour index past end of palette")
+    {
+        // An 8bpp BMP whose pixel stream contains a colour index larger
+        // than the palette colour count. Used to read past the palette
+        // buffer in the decode loops.
+        static const unsigned char data[] =
+        {
+            0x42,0x4d,0x3a,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x09,0x00,
+            0x00,0x00,0x28,0x00,0x00,0x00,0x28,0x00,0x00,0x00,0x01,0x00,
+            0x00,0x00,0x01,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+            0x42,0x4d,0x3a,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,
+            0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x2b,0x00,
+            0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+            0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x05,
+            0x00,0x00,0x00,0x00,0x00,0x28,0x00,0x00,0x00,0x01,0x00,0x00,
+        };
+        wxMemoryInputStream mis(data, WXSIZEOF(data));
+        wxImage img;
+        REQUIRE( !img.LoadFile(mis, wxBITMAP_TYPE_BMP) );
+    }
     wxImage image;
     SECTION("32bpp alpha")
     {