diff --git a/src/tsm/tsm-screen.c b/src/tsm/tsm-screen.c
index 5f532bb..bf37bad 100644
--- a/src/tsm/tsm-screen.c
+++ b/src/tsm/tsm-screen.c
@@ -1349,6 +1349,11 @@ void tsm_screen_tab_left(struct tsm_screen *con, unsigned int num)
 	screen_inc_age(con);
 
 	x = con->cursor_x;
+
+	/* cursor_x may exceed size_x (e.g. CHT then a wide glyph at the last
+	 * column); clamp before indexing tab_ruler[0..size_x-1]. */
+	if (x > con->size_x)
+		x = con->size_x;
 	for (i = 0; i < num; ++i) {
 		for (j = x - 1; j > 0; --j) {
 			if (con->tab_ruler[j])
diff --git a/src/tsm/tsm-vte.c b/src/tsm/tsm-vte.c
index 44ec5a0..04bbe21 100644
--- a/src/tsm/tsm-vte.c
+++ b/src/tsm/tsm-vte.c
@@ -1306,6 +1306,12 @@ static void greyscale_rgb(int code, uint8_t *cr, uint8_t *cg, uint8_t *cb)
 static void lookup_color(struct tsm_vte *vte, int color, uint8_t *cr,
 			 uint8_t *cg, uint8_t *cb)
 {
+	/* OSC-4 / SGR color indices are untrusted; an out-of-range (or
+	 * unsigned-overflow-negative) index would wild-read palette[]/bval[]. */
+	if (color < 0 || color > 255) {
+		*cr = *cg = *cb = 0;
+		return;
+	}
 	if (color < 16) {
 		palette_rgb(vte, color, cr, cg, cb);
 	} else if (color < 232) {
@@ -1479,6 +1485,10 @@ static void csi_attribute(struct tsm_vte *vte)
 			/* fallthrough */
 		case 48:
 			val = vte->csi_argv[i];
+			/* the 5/2 subcommand + its operands live in later argv slots;
+			 * bail if they would read past the parsed args (csi_argv[16] OOB). */
+			if (i + 1 >= vte->csi_argc)
+				break;
 			if (vte->csi_argv[i + 1] == 5) { // 256color mode
 				if (i + 2 >= vte->csi_argc ||
 					vte->csi_argv[i + 2] < 0) {