diff --git a/src/common/strconv.cpp b/src/common/strconv.cpp
index ec06c5819b..2b2f9fd60b 100644
--- a/src/common/strconv.cpp
+++ b/src/common/strconv.cpp
@@ -702,7 +702,7 @@ size_t wxMBConvUTF7::ToWChar(wchar_t *dst, size_t dstLen,
                     len++;
                     src++;
                 }
-                else if ( utf7unb64[(unsigned)*src] == 0xff )
+                else if ( utf7unb64[(unsigned char)*src] == 0xff )
                 {
                     // empty encoded chunks are not allowed
                     if ( !len )
diff --git a/tests/mbconv/mbconvtest.cpp b/tests/mbconv/mbconvtest.cpp
index 6cb9868824..9fa3d21866 100644
--- a/tests/mbconv/mbconvtest.cpp
+++ b/tests/mbconv/mbconvtest.cpp
@@ -1495,4 +1495,9 @@ TEST_CASE("wxMBConv::cMB2WC", "[mbconv][mb2wc]")
     CHECK( wxConvUTF7.cMB2WC("").length() == 0 );
     CHECK( wxConvUTF7.cMB2WC(wxCharBuffer()).length() == 0 );
     CHECK( wxConvUTF7.cMB2WC("+AKM-").length() == 1 );
+
+    // A non-ASCII byte right after the shift character used to be read past
+    // the end of the base-64 decoding table (signed char index), now it's
+    // just rejected as an invalid encoded chunk.
+    CHECK( wxConvUTF7.cMB2WC("+\xc3").length() == 0 );
 }