diff --git a/src/Tests/PdfNormalizerTests.cs b/src/Tests/PdfNormalizerTests.cs
index 125bd08..8c85cc2 100644
--- a/src/Tests/PdfNormalizerTests.cs
+++ b/src/Tests/PdfNormalizerTests.cs
@@ -105,6 +105,17 @@ public void LeavesLookalikeKeysUntouched()
         Assert.That(Normalize(input), Is.EqualTo(input));
     }
 
+    [Test]
+    public void HandlesUnterminatedFileIdWithoutOverrunning()
+    {
+        // A truncated /ID whose string runs to the end of the buffer with no closing '>'/')' (and no
+        // closing ']') must not scan past the buffer: the value is zeroed as far as it exists and the
+        // scan stops cleanly rather than throwing. Hex string form (no closing '>'):
+        Assert.That(Normalize("/ID [<ABCD"), Is.EqualTo("/ID [<0000"));
+        // Literal string form (no closing ')'):
+        Assert.That(Normalize("/ID [(ABCD"), Is.EqualTo("/ID [(0000"));
+    }
+
     [Test]
     public void NormalizedDocumentStillLoads()
     {
diff --git a/src/Verify.DocNet/PdfNormalizer.cs b/src/Verify.DocNet/PdfNormalizer.cs
index 93cd993..dd32fa4 100644
--- a/src/Verify.DocNet/PdfNormalizer.cs
+++ b/src/Verify.DocNet/PdfNormalizer.cs
@@ -124,14 +124,20 @@ static void ZeroFileId(byte[] data)
                     var start = i + 1;
                     i = FindByte(data, start, (byte) '>');
                     Overwrite(data, start, i, Fill.Hex);
-                    i++;
+                    if (i < data.Length)
+                    {
+                        i++;
+                    }
                 }
                 else if (data[i] == (byte) '(')
                 {
                     var start = i + 1;
                     i = FindLiteralEnd(data, start);
                     Overwrite(data, start, i, Fill.All);
-                    i++;
+                    if (i < data.Length)
+                    {
+                        i++;
+                    }
                 }
                 else
                 {