diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9d6861193..1cba0dc5a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Fixes and improvements
 
+* Fix memory-safety issues in the model loader (#2068) by [@jordimas](https://github.com/jordimas), reported by Chegne Eu Joe (Project Umbra)
 * Upgrade Thrust submodule from 1.12.0 to CCCL 2.7.0 (#2062) by [@jordimas](https://github.com/jordimas)
 
 ## [v4.8.0](https://github.com/OpenNMT/CTranslate2/releases/tag/v4.8.0) (2026-06-06)
diff --git a/src/models/model.cc b/src/models/model.cc
index 1193fce53..945fc5b15 100644
--- a/src/models/model.cc
+++ b/src/models/model.cc
@@ -80,8 +80,10 @@ namespace ctranslate2 {
     template<>
     std::string consume(std::istream& in) {
       const auto str_length = consume<uint16_t>(in);
+      if (str_length == 0)
+        throw std::runtime_error("Invalid string length in " + binary_file);
       const auto c_str = consume<char>(in, str_length);
-      std::string str(c_str);
+      std::string str(c_str, str_length - 1);
       delete [] c_str;
       return str;
     }
@@ -654,6 +656,8 @@ namespace ctranslate2 {
         }
 
         StorageView variable(std::move(shape), dtype);
+        if (num_bytes != variable.size() * variable.item_size())
+          throw std::runtime_error("Variable '" + name + "' has an invalid payload size");
         consume<char>(model_file, num_bytes, static_cast<char*>(variable.buffer()));
         if (tensor_parallel) {
           int outer_dim = 0;