diff --git a/Tests/LibGfx/TestImageDecoder.cpp b/Tests/LibGfx/TestImageDecoder.cpp
index 55de6c1292..444f98f0e4 100644
--- a/Tests/LibGfx/TestImageDecoder.cpp
+++ b/Tests/LibGfx/TestImageDecoder.cpp
@@ -177,6 +177,17 @@ TEST_CASE(test_bmp_embedded_in_ico)
     EXPECT_EQ(frame.image->get_pixel(7, 4), Gfx::Color(161, 0, 0));
 }
 
+TEST_CASE(test_malformed_maskless_ico)
+{
+    auto file = TRY_OR_FAIL(Core::MappedFile::map(TEST_INPUT("ico/malformed_maskless.ico"sv)));
+    EXPECT(Gfx::ICOImageDecoderPlugin::sniff(file->bytes()));
+    auto plugin_decoder = TRY_OR_FAIL(Gfx::ICOImageDecoderPlugin::create(file->bytes()));
+
+    auto frame = TRY_OR_FAIL(expect_single_frame_of_size(*plugin_decoder, { 16, 16 }));
+    EXPECT_EQ(frame.image->get_pixel(0, 0), Gfx::Color::NamedColor::Transparent);
+    EXPECT_EQ(frame.image->get_pixel(7, 4), Gfx::Color(161, 0, 0));
+}
+
 TEST_CASE(test_ilbm)
 {
     auto file = MUST(Core::MappedFile::map(TEST_INPUT("ilbm/gradient.iff"sv)));
diff --git a/Tests/LibGfx/test-inputs/ico/malformed_maskless.ico b/Tests/LibGfx/test-inputs/ico/malformed_maskless.ico
new file mode 100644
index 0000000000..3736d606c1
Binary files /dev/null and b/Tests/LibGfx/test-inputs/ico/malformed_maskless.ico differ
diff --git a/Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp b/Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp
index f5b8e0bda1..eca50ef10f 100644
--- a/Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp
+++ b/Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp
@@ -1429,7 +1429,7 @@ static ErrorOr<void> decode_bmp_pixel_data(BMPLoadingContext& context)
             TRY(process_row(row));
         }
 
-        if (context.is_included_in_ico) {
+        if (context.is_included_in_ico && !streamer.at_end()) {
             for (u32 row = 0; row < height; ++row) {
                 TRY(process_mask_row(row));
             }
@@ -1440,7 +1440,7 @@ static ErrorOr<void> decode_bmp_pixel_data(BMPLoadingContext& context)
             TRY(process_row(row));
         }
 
-        if (context.is_included_in_ico) {
+        if (context.is_included_in_ico && !streamer.at_end()) {
             for (i32 row = height - 1; row >= 0; --row) {
                 TRY(process_mask_row(row));
             }