diff --git a/changes-entries/mime-magic-negative-offset.txt b/changes-entries/mime-magic-negative-offset.txt
new file mode 100644
index 00000000000..c8566b8f87a
--- /dev/null
+++ b/changes-entries/mime-magic-negative-offset.txt
@@ -0,0 +1,3 @@
+  *) mod_mime_magic: Reject negative indirect offsets in mget() so a crafted
+     file cannot drive an out-of-bounds read of the sniff buffer.
+     [arshiya tabasum]
diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c
index 799d3fc5631..aa13c649bd9 100644
--- a/modules/metadata/mod_mime_magic.c
+++ b/modules/metadata/mod_mime_magic.c
@@ -1814,7 +1814,7 @@ static int mget(request_rec *r, union VALUETYPE *p, unsigned char *s,
 {
     long offset = m->offset;
 
-    if (offset + sizeof(union VALUETYPE) > nbytes)
+    if (offset < 0 || (apr_size_t)offset + sizeof(union VALUETYPE) > nbytes)
                   return 0;
 
     memcpy(p, s + offset, sizeof(union VALUETYPE));
@@ -1836,7 +1836,7 @@ static int mget(request_rec *r, union VALUETYPE *p, unsigned char *s,
             break;
         }
 
-        if (offset + sizeof(union VALUETYPE) > nbytes)
+        if (offset < 0 || (apr_size_t)offset + sizeof(union VALUETYPE) > nbytes)
                       return 0;
 
         memcpy(p, s + offset, sizeof(union VALUETYPE));