diff --git a/NEWS b/NEWS
index 378643836c80..38d1a66802bd 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.25
 
+- BCMath:
+  . Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds
+    n_scale. (iliaal)
+
 - Date:
   . Fixed leak on double DatePeriod::__construct() call. (ilutov)
 
diff --git a/ext/bcmath/libbcmath/src/zero.c b/ext/bcmath/libbcmath/src/zero.c
index 550ea97df674..e488069bae17 100644
--- a/ext/bcmath/libbcmath/src/zero.c
+++ b/ext/bcmath/libbcmath/src/zero.c
@@ -45,6 +45,10 @@ bool bc_is_zero_for_scale(bc_num num, size_t scale)
 		return true;
 	}
 
+	if (scale > num->n_scale) {
+		scale = num->n_scale;
+	}
+
 	/* Initialize */
 	count = num->n_len + scale;
 	nptr = num->n_value;
diff --git a/ext/bcmath/tests/bc_is_zero_for_scale_clamp.phpt b/ext/bcmath/tests/bc_is_zero_for_scale_clamp.phpt
new file mode 100644
index 000000000000..887fabb92916
--- /dev/null
+++ b/ext/bcmath/tests/bc_is_zero_for_scale_clamp.phpt
@@ -0,0 +1,12 @@
+--TEST--
+bc_is_zero_for_scale clamps scale to n_scale (Number::compare opposite signs)
+--EXTENSIONS--
+bcmath
+--FILE--
+<?php
+$shortZero = (new BcMath\Number('1.0'))->sub('1.0');
+$longNegative = new BcMath\Number('-0.' . str_repeat('0', 64) . '1');
+var_dump($shortZero->compare($longNegative, 64));
+?>
+--EXPECT--
+int(0)