diff --git a/ChangeLog.d/ecdh-psk-integer-overflow.txt b/ChangeLog.d/ecdh-psk-integer-overflow.txt
new file mode 100644
index 0000000000..47dfd428de
--- /dev/null
+++ b/ChangeLog.d/ecdh-psk-integer-overflow.txt
@@ -0,0 +1,3 @@
+Security
+   * Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when
+     CBC is disabled. Reported by Karnakar Reddy. CVE-2026-50580
diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c
index c49f2842d9..8799287a09 100644
--- a/library/ssl_tls12_client.c
+++ b/library/ssl_tls12_client.c
@@ -2472,11 +2472,16 @@ static int ssl_write_client_key_exchange(mbedtls_ssl_context *ssl)
 
         /* uint16 to store content length */
         const size_t content_len_size = 2;
+        const size_t ecpoint_len_size = 1;
+        const size_t ecpoint_max_len =
+            PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(handshake->xxdh_psa_type,
+                                              handshake->xxdh_psa_bits);
 
         header_len = 4;
 
-        if (header_len + content_len_size + ssl->conf->psk_identity_len
-            > MBEDTLS_SSL_OUT_CONTENT_LEN) {
+        if (ecpoint_max_len > MBEDTLS_SSL_OUT_CONTENT_LEN - ecpoint_len_size ||
+            header_len + content_len_size + ssl->conf->psk_identity_len
+            > MBEDTLS_SSL_OUT_CONTENT_LEN - ecpoint_len_size - ecpoint_max_len) {
             MBEDTLS_SSL_DEBUG_MSG(1,
                                   ("psk identity too long or SSL buffer too short"));
             return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 4a4ee4d1ef..9ab566944d 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -8382,6 +8382,37 @@ run_test    "extKeyUsage cli-auth 1.3: codeSign -> fail (hard)" \
             -s "Processing of the Certificate handshake message failed"
             # MBEDTLS_X509_BADCERT_EXT_KEY_USAGE  -> MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT
 
+# Miscellaneous PSK-related tests
+
+psk_identity_max_minus_10=a$(printf "%$((MAX_OUT_LEN - 11))s" z | tr ' ' .)
+
+run_test    "Large PSK identity (MBEDTLS_SSL_OUT_CONTENT_LEN - 7)" \
+            "$P_SRV debug_level=3 \
+                    psk_identity=${psk_identity_max_minus_10}987 psk=73776f726466697368" \
+            "$P_CLI force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 debug_level=3 \
+                    psk_identity=${psk_identity_max_minus_10}987 psk=73776f726466697368" \
+            1 \
+            -s "! mbedtls_ssl_handshake returned" \
+            -c "! mbedtls_ssl_handshake returned"
+
+run_test    "Large PSK identity (MBEDTLS_SSL_OUT_CONTENT_LEN - 6)" \
+            "$P_SRV debug_level=3 \
+                    psk_identity=${psk_identity_max_minus_10}9876 psk=73776f726466697368" \
+            "$P_CLI force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 debug_level=3 \
+                    psk_identity=${psk_identity_max_minus_10}9876 psk=73776f726466697368" \
+            1 \
+            -s "! mbedtls_ssl_handshake returned" \
+            -c "! mbedtls_ssl_handshake returned"
+
+run_test    "Large PSK identity (MBEDTLS_SSL_OUT_CONTENT_LEN - 5)" \
+            "$P_SRV debug_level=3 \
+                    psk_identity=${psk_identity_max_minus_10}98765 psk=73776f726466697368" \
+            "$P_CLI force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 debug_level=3 \
+                    psk_identity=${psk_identity_max_minus_10}98765 psk=73776f726466697368" \
+            1 \
+            -s "! mbedtls_ssl_handshake returned" \
+            -c "! mbedtls_ssl_handshake returned"
+
 # Tests for PSK callback
 
 run_test    "PSK callback: psk, no callback" \