diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c b/components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c
index 20d623147bba..c0d8c719bf71 100644
--- a/components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c
+++ b/components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c
@@ -263,7 +263,7 @@ static int wpa3_sae_is_group_enabled(int group)
 
 static int wpa3_check_sae_rejected_groups(const struct wpabuf *groups)
 {
-    size_t i, count;
+    size_t i, count, len;
     const u8 *pos;
 
     if (!groups) {
@@ -271,7 +271,14 @@ static int wpa3_check_sae_rejected_groups(const struct wpabuf *groups)
     }
 
     pos = wpabuf_head(groups);
-    count = wpabuf_len(groups) / 2;
+    len = wpabuf_len(groups);
+    if (len & 1) {
+        wpa_printf(MSG_DEBUG,
+                   "SAE: Invalid length of the Rejected Groups element payload: %zu",
+                   len);
+        return 1;
+    }
+    count = len / 2;
     for (i = 0; i < count; i++) {
         int enabled;
         u16 group;