diff --git a/block/src/formats/qcow/internal/header.rs b/block/src/formats/qcow/internal/header.rs
index ece9acd4a..4a16b8a00 100644
--- a/block/src/formats/qcow/internal/header.rs
+++ b/block/src/formats/qcow/internal/header.rs
@@ -336,6 +336,11 @@ impl QcowHeader {
                 header.backing_file_size,
             ));
         }
+        if header.backing_file_offset != 0 && header.backing_file_size == 0 {
+            return Err(Error::BackingFileOffsetWithoutSize(
+                header.backing_file_offset,
+            ));
+        }
         if header.backing_file_offset != 0 {
             let cluster_size = 1u64
                 .checked_shl(header.cluster_bits)
diff --git a/block/src/formats/qcow/internal/mod.rs b/block/src/formats/qcow/internal/mod.rs
index ab4e6776c..b3203d2f8 100644
--- a/block/src/formats/qcow/internal/mod.rs
+++ b/block/src/formats/qcow/internal/mod.rs
@@ -66,6 +66,8 @@ use crate::error::{BlockError, BlockErrorKind, BlockResult};
 pub enum Error {
     #[error("Backing file I/O error: {0}")]
     BackingFileIo(String /* path */, #[source] io::Error),
+    #[error("Backing file offset {0:#x} with zero size")]
+    BackingFileOffsetWithoutSize(u64),
     #[error("Backing file open error: {0}")]
     BackingFileOpen(String /* path */, #[source] Box<Error>),
     #[error(