diff --git a/Tests/LibGfx/TestWOFF2.cpp b/Tests/LibGfx/TestWOFF2.cpp
index 221ff53110..467f022ffb 100644
--- a/Tests/LibGfx/TestWOFF2.cpp
+++ b/Tests/LibGfx/TestWOFF2.cpp
@@ -20,3 +20,16 @@ TEST_CASE(tolerate_incorrect_sfnt_size)
     EXPECT_EQ(font->family(), "Test"_string);
     EXPECT_EQ(font->glyph_count(), 4u);
 }
+
+TEST_CASE(malformed_woff2)
+{
+    Array test_inputs = {
+        TEST_INPUT("woff2/incorrect_compressed_size.woff2"sv)
+    };
+
+    for (auto test_input : test_inputs) {
+        auto file = MUST(Core::MappedFile::map(test_input));
+        auto font_or_error = WOFF2::Font::try_load_from_externally_owned_memory(file->bytes());
+        EXPECT(font_or_error.is_error());
+    }
+}
diff --git a/Tests/LibGfx/test-inputs/woff2/incorrect_compressed_size.woff2 b/Tests/LibGfx/test-inputs/woff2/incorrect_compressed_size.woff2
new file mode 100644
index 0000000000..316f55fc87
Binary files /dev/null and b/Tests/LibGfx/test-inputs/woff2/incorrect_compressed_size.woff2 differ
diff --git a/Userland/Libraries/LibGfx/Font/WOFF2/Font.cpp b/Userland/Libraries/LibGfx/Font/WOFF2/Font.cpp
index f22a894995..ba813a7791 100644
--- a/Userland/Libraries/LibGfx/Font/WOFF2/Font.cpp
+++ b/Userland/Libraries/LibGfx/Font/WOFF2/Font.cpp
@@ -859,6 +859,8 @@ ErrorOr<NonnullRefPtr<Font>> Font::try_load_from_externally_owned_memory(Seekabl
     static constexpr size_t MAX_BUFFER_SIZE = 10 * MiB;
     if (header.length > TRY(stream.size()))
         return Error::from_string_literal("Invalid WOFF length");
+    if (header.total_compressed_size > MAX_BUFFER_SIZE)
+        return Error::from_string_literal("Compressed font is more than 10 MiB");
     if (header.meta_length == 0 && header.meta_offset != 0)
         return Error::from_string_literal("Invalid WOFF meta block offset");
     if (header.priv_length == 0 && header.priv_offset != 0)