diff --git a/src/core/net/ip6_address.cpp b/src/core/net/ip6_address.cpp
index 0bd765adf..57797a057 100644
--- a/src/core/net/ip6_address.cpp
+++ b/src/core/net/ip6_address.cpp
@@ -316,6 +316,9 @@ otError Address::FromString(const char *aBuf)
 
             // Do not count bytes of the embedded IPv4 address.
             endp -= kIp4AddressSize;
+
+            VerifyOrExit(dst <= endp, error = OT_ERROR_PARSE);
+
             break;
         }
         else
diff --git a/tests/unit/test_ip6_address.cpp b/tests/unit/test_ip6_address.cpp
index e6b83aeb0..bda00293c 100644
--- a/tests/unit/test_ip6_address.cpp
+++ b/tests/unit/test_ip6_address.cpp
@@ -189,6 +189,13 @@ void TestIp6AddressFromString(void)
             {0},
             OT_ERROR_PARSE
         },
+
+        // Invalid embedded IPv4 address.
+        {
+            ":f:0:0:c:0:f:f:.",
+            {0},
+            OT_ERROR_PARSE
+        },
     };
 
     for (uint32_t index = 0; index < OT_ARRAY_LENGTH(testVectors); index++)