diff --git a/lib/zebra.h b/lib/zebra.h
index 00d422cdd1..b2f0202c53 100644
--- a/lib/zebra.h
+++ b/lib/zebra.h
@@ -360,6 +360,8 @@ typedef enum {
 	AFI_MAX = 4
 } afi_t;
 
+#define IS_VALID_AFI(a) ((a) > AFI_UNSPEC && (a) < AFI_MAX)
+
 /* Subsequent Address Family Identifier. */
 typedef enum {
 	SAFI_UNSPEC = 0,
diff --git a/zebra/zapi_msg.c b/zebra/zapi_msg.c
index e3feddba52..c21d00bbe6 100644
--- a/zebra/zapi_msg.c
+++ b/zebra/zapi_msg.c
@@ -2277,6 +2277,12 @@ static void zread_vrf_label(ZAPI_HANDLER_ARGS)
 	s = msg;
 	STREAM_GETL(s, nlabel);
 	STREAM_GETC(s, afi);
+
+	if (!(IS_VALID_AFI(afi))) {
+		zlog_warn("Invalid AFI for VRF label: %u", afi);
+		return;
+	}
+
 	if (nlabel == zvrf->label[afi]) {
 		/*
 		 * Nothing to do here move along