diff --git a/drivers/contactless/mfrc522.c b/drivers/contactless/mfrc522.c
index 2f745382581..db03cc79004 100644
--- a/drivers/contactless/mfrc522.c
+++ b/drivers/contactless/mfrc522.c
@@ -1221,6 +1221,14 @@ int mfrc522_mifare_read(FAR struct mfrc522_dev_s *dev,
   uint8_t validbits = 0;
   int     ret       = OK;
 
+  /* Validate expected tag size (only pages 0x0, ..., 0xf are valid. */
+
+  if (data->address > 15)
+    {
+      ret = -ERANGE;
+      goto errout;
+    }
+
   /* Read block from address */
 
   command[0] = PICC_CMD_MF_READ;
diff --git a/drivers/contactless/pn532.c b/drivers/contactless/pn532.c
index 7fea654be86..88e631bd9ef 100644
--- a/drivers/contactless/pn532.c
+++ b/drivers/contactless/pn532.c
@@ -637,6 +637,13 @@ uint32_t pn532_write_passive_data(FAR struct pn532_dev_s *dev,
   uint8_t resp[20];
   uint32_t res = -EIO;
 
+  /* Validate expected tag size (only pages 0x0, ..., 0xf are valid. */
+
+  if (address > 15)
+    {
+      return -ERANGE;
+    }
+
   pn532_frame_init(f, PN532_COMMAND_INDATAEXCHANGE);
   f->data[1] = 1;       /* max n cards at once */
   f->data[2] = 0xa2;    /* command WRITE */
@@ -677,6 +684,13 @@ uint32_t pn532_read_passive_data(FAR struct pn532_dev_s *dev,
   uint8_t resp[30];
   uint32_t res = -1;
 
+  /* Validate against expected tag size */
+
+  if (address > 15)
+    {
+      return -ERANGE;
+    }
+
   pn532_frame_init(f, PN532_COMMAND_INDATAEXCHANGE);
   f->data[1] = 1;       /* max n cards at once */
   f->data[2] = 0x30;    /* command READ */