diff --git a/NEWS b/NEWS
index facc4a1d0031..ff5275bc58a7 100644
--- a/NEWS
+++ b/NEWS
@@ -59,6 +59,10 @@ PHP                                                                        NEWS
   . Fix trampoline leak when object construction fails for lazy object.
     (ndossche)
 
+- Standard:
+  . Fixed getimagesize() reporting wrapped dimensions for XBM images with
+    out-of-range width or height. (Ilia Alshanetsky)
+
 - Streams:
   . Fixed bug GH-22063 (Stream filter chain UAF on self-removal during
     callback). (Ilia Alshanetsky)
diff --git a/ext/standard/image.c b/ext/standard/image.c
index f58569495d39..58795384f811 100644
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -1000,7 +1000,9 @@ static int php_get_xbm(php_stream *stream, struct gfxinfo **result)
 	char *fline;
 	char *iname;
 	char *type;
-	int value;
+	char *end;
+	int offset;
+	long value;
 	unsigned int width = 0, height = 0;
 
 	if (result) {
@@ -1017,25 +1019,29 @@ static int php_get_xbm(php_stream *stream, struct gfxinfo **result)
 			break;
 		}
 		iname = estrdup(fline); /* simple way to get necessary buffer of required size */
-		if (sscanf(fline, "#define %s %d", iname, &value) == 2) {
-			if (!(type = strrchr(iname, '_'))) {
-				type = iname;
-			} else {
-				type++;
-			}
+		if (sscanf(fline, "#define %s %n", iname, &offset) == 1) {
+			errno = 0;
+			value = strtol(fline + offset, &end, 10);
+			if (end != fline + offset && errno == 0 && value > 0 && value <= INT_MAX) {
+				if (!(type = strrchr(iname, '_'))) {
+					type = iname;
+				} else {
+					type++;
+				}
 
-			if (!strcmp("width", type)) {
-				width = (unsigned int) value;
-				if (height) {
-					efree(iname);
-					break;
+				if (!strcmp("width", type)) {
+					width = (unsigned int) value;
+					if (height) {
+						efree(iname);
+						break;
+					}
 				}
-			}
-			if (!strcmp("height", type)) {
-				height = (unsigned int) value;
-				if (width) {
-					efree(iname);
-					break;
+				if (!strcmp("height", type)) {
+					height = (unsigned int) value;
+					if (width) {
+						efree(iname);
+						break;
+					}
 				}
 			}
 		}
diff --git a/ext/standard/tests/image/xbm_out_of_range.phpt b/ext/standard/tests/image/xbm_out_of_range.phpt
new file mode 100644
index 000000000000..1252b00c945a
--- /dev/null
+++ b/ext/standard/tests/image/xbm_out_of_range.phpt
@@ -0,0 +1,21 @@
+--TEST--
+getimagesize() rejects out-of-range XBM dimensions
+--FILE--
+<?php
+$path = __DIR__ . '/xbm_out_of_range.tmp.xbm';
+foreach ([['4294967298', '1'], ['1', '4294967298'], ['2147483648', '1'], ['-5', '1'], ['2147483647', '1']] as [$w, $h]) {
+    file_put_contents($path, "#define x_width $w\n#define x_height $h\nstatic char x_bits[] = {\n0x00 };\n");
+    $info = getimagesize($path);
+    echo "$w x $h: ", $info ? $info[3] : 'false', "\n";
+}
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/xbm_out_of_range.tmp.xbm');
+?>
+--EXPECT--
+4294967298 x 1: false
+1 x 4294967298: false
+2147483648 x 1: false
+-5 x 1: false
+2147483647 x 1: width="2147483647" height="1"