diff --git a/openair3/NAS/NR_UE/nr_nas_msg.c b/openair3/NAS/NR_UE/nr_nas_msg.c
index b1378c3360..e62cf12e3b 100644
--- a/openair3/NAS/NR_UE/nr_nas_msg.c
+++ b/openair3/NAS/NR_UE/nr_nas_msg.c
@@ -32,6 +32,7 @@
 #include "nr_nas_msg.h"
 #include <netinet/in.h>
 #include "NR_NAS_defs.h"
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -1798,10 +1799,23 @@ void *nas_nrue(void *args_p)
           case FGS_PDU_SESSION_ESTABLISHMENT_REJ:
             LOG_E(NAS, "Received PDU Session Establishment reject\n");
             break;
-          case FGS_REGISTRATION_REJECT:
-            LOG_E(NAS, "Received Registration reject cause: %s\n", cause_text_info[pdu_buffer[17]].text);
+          case FGS_REGISTRATION_REJECT: {
+
+            if (pdu_length < 18) {
+              LOG_E(NAS, "Received Registration reject message too short\n");
+              break;
+            }
+
+            uint8_t cause = pdu_buffer[17];
+            if (cause >= sizeof(cause_text_info) / sizeof(cause_text_info[0])) {
+              LOG_E(NAS, "Received Registration reject cause %d unknown\n", cause);
+              break;
+            }
+
+            LOG_E(NAS, "Received Registration reject cause: %s\n", cause_text_info[cause].text);
             exit(1);
             break;
+          }
           case FGS_SERVICE_ACCEPT: {
             byte_array_t buffer = {.buf = pdu_buffer, .len = pdu_length};
             handle_service_accept(nas, &buffer);