diff --git a/sys/netproto/802_11/wlan/ieee80211_input.c b/sys/netproto/802_11/wlan/ieee80211_input.c
--- a/sys/netproto/802_11/wlan/ieee80211_input.c
+++ b/sys/netproto/802_11/wlan/ieee80211_input.c
@@ -550,6 +550,8 @@
 	scan->ies_len = efrm - frm;
 
 	while (efrm - frm > 1) {
+		if (frm[1] > efrm - frm - 2)
+			frm[1] = (uint8_t)(efrm - frm - 2);
 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2,
 		    return (scan->status = IEEE80211_BPARSE_BADIELEN));
 		switch (*frm) {