diff --git a/NEWS b/NEWS
index dd33ea598c3..4c8f00d13a1 100644
--- a/NEWS
+++ b/NEWS
@@ -71,6 +71,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-10885 (stream_socket_server context leaks). (ilutov)
   . Fixed bug GH-10052 (Browscap crashes PHP 8.1.12 on request shutdown
     (apache2)). (nielsdos)
+  . Fixed oss-fuzz #57392 (Buffer-overflow in php_fgetcsv() with \0 delimiter
+    and enclosure). (ilutov)
 
 16 Mar 2023, PHP 8.2.4
 
diff --git a/ext/standard/file.c b/ext/standard/file.c
index 1f3b6b2cf58..f40579dde59 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1970,7 +1970,7 @@ PHPAPI HashTable *php_fgetcsv(php_stream *stream, char delimiter, char enclosure
 			while ((*tmp != delimiter) && isspace((int)*(unsigned char *)tmp)) {
 				tmp++;
 			}
-			if (*tmp == enclosure) {
+			if (*tmp == enclosure && tmp < limit) {
 				bptr = tmp;
 			}
 		}
diff --git a/ext/standard/tests/oss_fuzz_57392.phpt b/ext/standard/tests/oss_fuzz_57392.phpt
new file mode 100644
index 00000000000..5a7e5b28d1c
--- /dev/null
+++ b/ext/standard/tests/oss_fuzz_57392.phpt
@@ -0,0 +1,17 @@
+--TEST--
+oss-fuzz #57392: Buffer-overflow in php_fgetcsv() with \0 delimiter and enclosure
+--FILE--
+<?php
+var_dump(str_getcsv(
+    "aaaaaaaaaaaa\0  ",
+    "\0",
+    "\0",
+));
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  string(12) "aaaaaaaaaaaa"
+  [1]=>
+  string(2) "  "
+}