diff --git a/ChangeLog.d/x509parse_crl-empty_entry.txt b/ChangeLog.d/x509parse_crl-empty_entry.txt
new file mode 100644
index 0000000..483abb1
--- /dev/null
+++ b/ChangeLog.d/x509parse_crl-empty_entry.txt
@@ -0,0 +1,4 @@
+Security
+   * Fix a 1-byte buffer overread in mbedtls_x509_crl_parse_der().
+     Credit to OSS-Fuzz for detecting the problem and to Philippe Antoine
+     for pinpointing the problematic code.
diff --git a/library/x509_crl.c b/library/x509_crl.c
index 94c0c01..e20a258 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -285,13 +285,13 @@
         size_t len2;
         const unsigned char *end2;
 
+        cur_entry->raw.tag = **p;
         if( ( ret = mbedtls_asn1_get_tag( p, end, &len2,
                 MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED ) ) != 0 )
         {
             return( ret );
         }
 
-        cur_entry->raw.tag = **p;
         cur_entry->raw.p = *p;
         cur_entry->raw.len = len2;
         end2 = *p + len2;