diff --git a/dom/media/eme/clearkey/ClearKeyDecryptionManager.cpp b/dom/media/eme/clearkey/ClearKeyDecryptionManager.cpp
index 328360a0311..eaea6bf09b6 100644
--- a/dom/media/eme/clearkey/ClearKeyDecryptionManager.cpp
+++ b/dom/media/eme/clearkey/ClearKeyDecryptionManager.cpp
@@ -265,6 +265,12 @@ Status ClearKeyDecryptor::Decrypt(uint8_t* aBuffer, uint32_t aBufferSize,
   assert(aMetadata.mIV.size() == 8 || aMetadata.mIV.size() == 16 ||
          (aMetadata.mIV.empty() && AllZero(aMetadata.mCipherBytes)));
 
+  if (aMetadata.mIV.size() > CENC_KEY_LEN) {
+    CK_LOGD("ClearKeyDecryptor::Decrypt unexpected IV size %zu",
+            aMetadata.mIV.size());
+    return Status::kDecryptError;
+  }
+
   std::vector<uint8_t> iv(aMetadata.mIV);
   iv.insert(iv.end(), CENC_KEY_LEN - aMetadata.mIV.size(), 0);
 
diff --git a/dom/media/mp4/SinfParser.cpp b/dom/media/mp4/SinfParser.cpp
index 4ffb4ff2f09..1455e89c0c5 100644
--- a/dom/media/mp4/SinfParser.cpp
+++ b/dom/media/mp4/SinfParser.cpp
@@ -7,6 +7,8 @@
 #include "AtomType.h"
 #include "Box.h"
 #include "ByteStream.h"
+#include "MediaDataDemuxer.h"
+#include "mozilla/Logging.h"
 #include "mozilla/Try.h"
 
 namespace mozilla {
@@ -73,7 +75,14 @@ Result<Ok, nsresult> SinfParser::ParseTenc(const Box& aBox) {
   }
 
   uint8_t isEncrypted = MOZ_TRY(reader->ReadU8());
-  mSinf.mDefaultIVSize = MOZ_TRY(reader->ReadU8());
+  uint8_t defaultIVSize = MOZ_TRY(reader->ReadU8());
+  if (defaultIVSize != 0 && defaultIVSize != 8 && defaultIVSize != 16) {
+    MOZ_LOG(gMediaDemuxerLog, LogLevel::Warning,
+            ("SinfParser: unexpected default per-sample IV size %u",
+             static_cast<unsigned>(defaultIVSize)));
+    return Err(NS_ERROR_FAILURE);
+  }
+  mSinf.mDefaultIVSize = defaultIVSize;
   memcpy(mSinf.mDefaultKeyID, reader->Read(16), 16);
 
   if (isEncrypted && mSinf.mDefaultIVSize == 0) {