diff --git a/esphome/components/tx20/tx20.cpp b/esphome/components/tx20/tx20.cpp
index aa2b6535563..6516f936f38 100644
--- a/esphome/components/tx20/tx20.cpp
+++ b/esphome/components/tx20/tx20.cpp
@@ -48,8 +48,10 @@ void Tx20Component::decode_and_publish_() {
   std::array<bool, MAX_BUFFER_SIZE> bit_buffer{};
   size_t bit_pos = 0;
   bool current_bit = true;
+  // Cap at MAX_BUFFER_SIZE to prevent out-of-bounds access (buffer_index can exceed MAX_BUFFER_SIZE in ISR)
+  const int max_buffer_index = std::min(static_cast<int>(this->store_.buffer_index), static_cast<int>(MAX_BUFFER_SIZE));
 
-  for (int i = 1; i <= this->store_.buffer_index; i++) {
+  for (int i = 1; i <= max_buffer_index; i++) {
     uint8_t repeat = this->store_.buffer[i] / TX20_BIT_TIME;
     // ignore segments at the end that were too short
     for (uint8_t j = 0; j < repeat && bit_pos < MAX_BUFFER_SIZE; j++) {
@@ -109,7 +111,7 @@ void Tx20Component::decode_and_publish_() {
   // Build debug strings from completed data
   char debug_buf[320];  // buffer values: max 42 entries * 7 chars each
   size_t debug_pos = 0;
-  for (int i = 1; i <= this->store_.buffer_index; i++) {
+  for (int i = 1; i <= max_buffer_index; i++) {
     debug_pos = buf_append_printf(debug_buf, sizeof(debug_buf), debug_pos, "%u, ", this->store_.buffer[i]);
   }
   if (bits_before_padding < MAX_BUFFER_SIZE) {