diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c
index 5a1bfe4d52..29b8acd351 100644
--- a/libavformat/iamf_parse.c
+++ b/libavformat/iamf_parse.c
@@ -776,6 +776,13 @@ static int audio_element_obu(void *s, IAMFContext *c, AVIOContext *pb, int len)
     }
 
     nb_substreams = ffio_read_leb(pbc);
+    /* Each substream consumes at least one byte (its leb128 id) from the
+     * remaining OBU buffer, so a count larger than that cannot be valid and
+     * would only serve to force an oversized allocation. */
+    if (nb_substreams > len - avio_tell(pbc) || !nb_substreams) {
+        ret = AVERROR_INVALIDDATA;
+        goto fail;
+    }
     audio_element->codec_config_id = codec_config_id;
     audio_element->audio_element_id = audio_element_id;
     audio_element->substreams = av_calloc(nb_substreams, sizeof(*audio_element->substreams));