diff --git a/NEWS b/NEWS
index 982945e5ebfc..6fcc446e5ee0 100644
--- a/NEWS
+++ b/NEWS
@@ -60,6 +60,8 @@ PHP                                                                        NEWS
   . Fixed three Windows-only proc_open() defects: an uninitialized
     PROCESS_INFORMATION, an indeterminate comspec pointer after a failed
     lookup, and an unchecked CreateFileA() failure. (Ilia Alshanetsky)
+  . Fixed out-of-bounds read when parsing a malformed MX answer in
+    dns_get_mx(). (Ilia Alshanetsky)
 
 - XSL:
   . Fixed bug GH-23730 (use-after-free when XSLTProcessor::importStylesheet()
diff --git a/ext/standard/dns.c b/ext/standard/dns.c
index 64301ed04161..61319565da7b 100644
--- a/ext/standard/dns.c
+++ b/ext/standard/dns.c
@@ -1120,6 +1120,10 @@ PHP_FUNCTION(dns_get_mx)
 			RETURN_FALSE;
 		}
 		cp += i;
+		if (cp + 10 > end) {
+			php_dns_free_handle(handle);
+			RETURN_FALSE;
+		}
 		GETSHORT(type, cp);
 		cp += INT16SZ + INT32SZ;
 		GETSHORT(i, cp);
@@ -1127,6 +1131,10 @@ PHP_FUNCTION(dns_get_mx)
 			cp += i;
 			continue;
 		}
+		if (cp + 2 > end) {
+			php_dns_free_handle(handle);
+			RETURN_FALSE;
+		}
 		GETSHORT(weight, cp);
 		if ((i = dn_expand(answer.qb2, end, cp, buf, sizeof(buf)-1)) < 0) {
 			php_dns_free_handle(handle);