diff --git a/CHANGELOG b/CHANGELOG
index ec3b69f..f160ca4 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -8,6 +8,10 @@ version 2.94
 	constructed DHCPv6/RA - DHCPv6 and RA are inhibited by
 	--no-dhcpv4-interface when using constructed address ranges.
 	Thanks to David Nichols for discovery, diagnosis and patch.
+
+	Fix heap OOB read in zone_status. Thanks to Yaohui Zhu (朱耀辉)
+	for spotting and reporting this. A crafted reply can crash dnsmasq.
+	CNVD-C-2026-590208 applies.
 	
 	
 version 2.93
diff --git a/src/dnssec.c b/src/dnssec.c
index 54de836..f874b61 100644
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -1934,7 +1934,7 @@ static int zone_status(char *name, int class, char *keyname, time_t now)
 	    return STAT_INSECURE;
 	}
 
-      if (name_start == 0)
+      if (name_start <= 1)
 	break;
 
       for (p = &name[name_start-2]; (*p != '.') && (p != name); p--);