diff --git a/ChangeLog.d/oob-key-exchange-restricted.txt b/ChangeLog.d/oob-key-exchange-restricted.txt
new file mode 100644
index 0000000000..2e48ce0fec
--- /dev/null
+++ b/ChangeLog.d/oob-key-exchange-restricted.txt
@@ -0,0 +1,4 @@
+Security
+   * Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange
+     messages. Reported-by Biniam Demissie.
+     CVE-2026-50588
diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c
index c101ccd91e..c49f2842d9 100644
--- a/library/ssl_tls12_client.c
+++ b/library/ssl_tls12_client.c
@@ -1931,6 +1931,8 @@ start_processing:
          * However since we only support secp256r1 for now, we check only
          * that TLS ID here
          */
+        MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 3);
+
         uint16_t read_tls_id = MBEDTLS_GET_UINT16_BE(p, 1);
         uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(
             MBEDTLS_ECP_DP_SECP256R1);