diff --git a/nimble/host/src/ble_gattc.c b/nimble/host/src/ble_gattc.c
index 3b30a01ca..e8ba32fbe 100644
--- a/nimble/host/src/ble_gattc.c
+++ b/nimble/host/src/ble_gattc.c
@@ -4173,6 +4173,11 @@ ble_gattc_write_long(uint16_t conn_handle, uint16_t attr_handle,
     /* The mbuf is consumed by the procedure. */
     txom = NULL;
 
+    if (proc->write_long.attr.offset > OS_MBUF_PKTLEN(proc->write_long.attr.om)) {
+        rc = BLE_ATT_ERR_INVALID_OFFSET;
+        goto done;
+    }
+
     ble_gattc_log_write_long(proc);
 
     rc = ble_gattc_write_long_tx(proc);