diff --git a/crates/ironrdp-pdu/src/rdp/server_license.rs b/crates/ironrdp-pdu/src/rdp/server_license.rs
index 8be3cf3a..bdaf6927 100644
--- a/crates/ironrdp-pdu/src/rdp/server_license.rs
+++ b/crates/ironrdp-pdu/src/rdp/server_license.rs
@@ -217,6 +217,8 @@ pub enum ServerLicenseError {
     InvalidRsaPublicKeyLength,
     #[error("invalid RSA public key data length")]
     InvalidRsaPublicKeyDataLength,
+    #[error("invalid RSA public key bit length")]
+    InvalidRsaPublicKeyBitLength,
     #[error("invalid License Header security flags")]
     InvalidSecurityFlags,
     #[error("the server returned unexpected error: {0:?}")]
diff --git a/crates/ironrdp-pdu/src/rdp/server_license/server_license_request/cert.rs b/crates/ironrdp-pdu/src/rdp/server_license/server_license_request/cert.rs
index 86e55d69..da675c90 100644
--- a/crates/ironrdp-pdu/src/rdp/server_license/server_license_request/cert.rs
+++ b/crates/ironrdp-pdu/src/rdp/server_license/server_license_request/cert.rs
@@ -160,6 +160,10 @@ impl PduParsing for RsaPublicKey {
             return Err(ServerLicenseError::InvalidRsaPublicKeyLength);
         }
 
+        if bitlen < 8 {
+            return Err(ServerLicenseError::InvalidRsaPublicKeyBitLength);
+        }
+
         let datalen = stream.read_u32::<LittleEndian>()?;
         if datalen != (bitlen / 8) - 1 {
             return Err(ServerLicenseError::InvalidRsaPublicKeyDataLength);
diff --git a/crates/ironrdp-testsuite-core/test_data/fuzz_regression/pdu_decode/crash-384d5ec1d99a93a3a53d206c9f808490d9b33d48 b/crates/ironrdp-testsuite-core/test_data/fuzz_regression/pdu_decode/crash-384d5ec1d99a93a3a53d206c9f808490d9b33d48
new file mode 100644
index 00000000..f188400c
Binary files /dev/null and b/crates/ironrdp-testsuite-core/test_data/fuzz_regression/pdu_decode/crash-384d5ec1d99a93a3a53d206c9f808490d9b33d48 differ