diff --git a/test/data/issue_ghsa_8949_hhfh_j7rj_poc.exv b/test/data/issue_ghsa_8949_hhfh_j7rj_poc.exv
new file mode 100644
index 0000000000..380779b3e6
Binary files /dev/null and b/test/data/issue_ghsa_8949_hhfh_j7rj_poc.exv differ
diff --git a/test/data/issue_ghsa_8949_hhfh_j7rj_poc.jp2 b/test/data/issue_ghsa_8949_hhfh_j7rj_poc.jp2
new file mode 100644
index 0000000000..a50cee7bf9
Binary files /dev/null and b/test/data/issue_ghsa_8949_hhfh_j7rj_poc.jp2 differ
diff --git a/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py b/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py
new file mode 100644
index 0000000000..c98b3815eb
--- /dev/null
+++ b/tests/bugfixes/github/test_issue_ghsa_8949_hhfh_j7rj.py
@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+
+from system_tests import CaseMeta, path
+
+
+class Jp2ImageEncodeJp2HeaderOutOfBoundsRead(metaclass=CaseMeta):
+    """
+    Regression test for the bug described in:
+    https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj
+    """
+    url = "https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj"
+
+    filename1 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.jp2")
+    filename2 = path("$data_path/issue_ghsa_8949_hhfh_j7rj_poc.exv")
+    commands = ["$exiv2 in $filename1"]
+    stdout = [""]
+    stderr = [
+"""Error: XMP Toolkit error 201: XML parsing failure
+Warning: Failed to decode XMP metadata.
+$filename1: Could not write metadata to file: $kerCorruptedMetadata
+"""]
+    retval = [1]