diff --git a/command/rakp12.cpp b/command/rakp12.cpp
index 9a31dfe..099c5dc 100644
--- a/command/rakp12.cpp
+++ b/command/rakp12.cpp
@@ -26,8 +26,15 @@
 std::vector<uint8_t> RAKP12(const std::vector<uint8_t>& inPayload,
                             const message::Handler& handler)
 {
-    std::vector<uint8_t> outPayload(sizeof(RAKP2response));
     auto request = reinterpret_cast<const RAKP1request*>(inPayload.data());
+    // verify inPayload minimum size
+    if (inPayload.size() < (sizeof(*request) - userNameMaxLen))
+    {
+        std::vector<uint8_t> errorPayload{IPMI_CC_REQ_DATA_LEN_INVALID};
+        return errorPayload;
+    }
+
+    std::vector<uint8_t> outPayload(sizeof(RAKP2response));
     auto response = reinterpret_cast<RAKP2response*>(outPayload.data());
 
     // Session ID zero is reserved for Session Setup