diff --git a/format/mpeg/hevc_vps.go b/format/mpeg/hevc_vps.go
index 5176e8b8..6bb5a70e 100644
--- a/format/mpeg/hevc_vps.go
+++ b/format/mpeg/hevc_vps.go
@@ -16,6 +16,8 @@ func init() {
 	})
 }
 
+const maxVpsLayers = 1000
+
 // H.265 page 33
 func hevcVPSDecode(d *decode.D, _ any) any {
 	d.FieldU4("vps_video_parameter_set_id")
@@ -42,6 +44,9 @@ func hevcVPSDecode(d *decode.D, _ any) any {
 	})
 	vpsMaxLayerID := d.FieldU6("vps_max_layer_id")
 	vpsNumLayerSetsMinus1 := d.FieldUFn("vps_num_layer_sets_minus1", uEV)
+	if vpsNumLayerSetsMinus1 > maxVpsLayers {
+		d.Errorf("too many vps layers %d > %d", vpsNumLayerSetsMinus1, maxVpsLayers)
+	}
 	d.FieldArray("layer_id_included_sets_flags", func(d *decode.D) {
 		for i := uint64(0); i <= vpsNumLayerSetsMinus1; i++ {
 			d.FieldArray("layer_id_included_sets_flags", func(d *decode.D) {