diff --git a/sys/bus/pccard/pccard_cis.c b/sys/bus/pccard/pccard_cis.c
--- a/sys/bus/pccard/pccard_cis.c
+++ b/sys/bus/pccard/pccard_cis.c
@@ -993,6 +993,8 @@
 						if ((reg >> j) & 0x01) {
 							/* skip over bytes */
 							do {
+								if (idx >= tuple->length)
+									goto abort_cfe;
 								reg2 = pccard_tuple_read_1(tuple, idx);
 								idx++;
 								/*
@@ -1241,6 +1243,8 @@
 				cfe->maxtwins = reg & PCCARD_TPCE_MI_MAXTWINS;
 
 				while (reg & PCCARD_TPCE_MI_EXT) {
+					if (idx >= tuple->length)
+						goto abort_cfe;
 					reg = pccard_tuple_read_1(tuple, idx);
 					idx++;
 				}