diff --git a/esphome/components/nfc/ndef_message.cpp b/esphome/components/nfc/ndef_message.cpp
index e7304445c55..35028555c55 100644
--- a/esphome/components/nfc/ndef_message.cpp
+++ b/esphome/components/nfc/ndef_message.cpp
@@ -8,8 +8,14 @@ static const char *const TAG = "nfc.ndef_message";
 
 NdefMessage::NdefMessage(std::vector<uint8_t> &data) {
   ESP_LOGV(TAG, "Building NdefMessage with %zu bytes", data.size());
-  uint8_t index = 0;
-  while (index <= data.size()) {
+  size_t index = 0;
+  while (index < data.size()) {
+    // Minimum record: TNF byte + type length byte + payload length (1 or 4 bytes)
+    if (index + 2 >= data.size()) {
+      ESP_LOGE(TAG, "Truncated record header; aborting");
+      break;
+    }
+
     uint8_t tnf_byte = data[index++];
     bool me = tnf_byte & 0x40;      // Message End bit (is set if this is the last record of the message)
     bool sr = tnf_byte & 0x10;      // Short record bit (is set if payload size is less or equal to 255 bytes)
@@ -23,6 +29,10 @@ NdefMessage::NdefMessage(std::vector<uint8_t> &data) {
     if (sr) {
       payload_length = data[index++];
     } else {
+      if (index + 4 > data.size()) {
+        ESP_LOGE(TAG, "Truncated payload length; aborting");
+        break;
+      }
       payload_length = (static_cast<uint32_t>(data[index]) << 24) | (static_cast<uint32_t>(data[index + 1]) << 16) |
                        (static_cast<uint32_t>(data[index + 2]) << 8) | static_cast<uint32_t>(data[index + 3]);
       index += 4;
@@ -30,6 +40,10 @@ NdefMessage::NdefMessage(std::vector<uint8_t> &data) {
 
     uint8_t id_length = 0;
     if (il) {
+      if (index >= data.size()) {
+        ESP_LOGE(TAG, "Truncated ID length; aborting");
+        break;
+      }
       id_length = data[index++];
     }