--- ./xmlregexp.c.orig	2026-09-04 17:59:38.128803903 -0500
+++ ./xmlregexp.c	2026-09-04 18:03:55.639124576 -0500
@@ -55,7 +55,9 @@
     xmlRegexpErrCompile(ctxt, str);
 #define NEXT ctxt->cur++
 #define CUR (*(ctxt->cur))
-#define NXT(index) (ctxt->cur[index])
+#define NXT(index)									\
+    (((size_t)(ctxt->cur + index - ctxt->string) < ctxt->len)				\
+      ? ctxt->cur[index] : 0)
 
 #define CUR_SCHAR(s, l) xmlStringCurrentChar(NULL, s, &l)
 #define NEXTL(l) ctxt->cur += l;
@@ -245,6 +247,7 @@
 struct _xmlAutomata {
     xmlChar *string;
     xmlChar *cur;
+    size_t len;
 
     int error;
     int neg;
@@ -722,6 +725,7 @@
     memset(ret, 0, sizeof(xmlRegParserCtxt));
     if (string != NULL)
 	ret->string = xmlStrdup(string);
+	ret->len = strlen((const char *) ret->string);
     ret->cur = ret->string;
     ret->neg = 0;
     ret->negs = 0;