diff --git a/CHANGELOG.md b/CHANGELOG.md
index c78393bd9..2ce0ae046 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@
 - NFC: **Fix "Update from Initial Card" dropping sectors from a MIFARE Classic dump** (by @mishamyte | PR #1066 | Fixes #1064)
 - NFC, LF RFID, iButton: **Renaming a saved file no longer deletes it before the replacement is written** (by @mishamyte | PR #1067 | Fixes #1065)
 - NFC: **Fix cards whose 4-byte UID starts with 0x88 failing to read** (by @mishamyte | PR #1075 | Fixes #1074)
+- NFC: **Harden ISO14443-3A anticollision against an unbounded UID cascade** (by @mishamyte | PR #1078 | Fixes #1077)
 - RPC: **Fix crash when starting an app over RPC** (by @apfxtech | PR #1076)
 - Apps: Build tag (**15aug2026**) - **Check out more Apps updates and fixes by following** [this link](https://github.com/xMasterX/all-the-plugins/commits/dev)
 
diff --git a/lib/nfc/protocols/iso14443_3a/iso14443_3a_poller_i.c b/lib/nfc/protocols/iso14443_3a/iso14443_3a_poller_i.c
index 004045f71..897e66c0a 100644
--- a/lib/nfc/protocols/iso14443_3a/iso14443_3a_poller_i.c
+++ b/lib/nfc/protocols/iso14443_3a/iso14443_3a_poller_i.c
@@ -216,6 +216,14 @@ Iso14443_3aError
                 // first UID byte: a real 4-byte UID can begin with the 0x88 cascade tag
                 // value (non-compliant, but seen on some MIFARE Classic / magic cards).
                 if(instance->col_res.sel_resp.sak & ISO14443_3A_POLLER_SAK_CASCADE_BIT) {
+                    // ISO14443-3 defines at most 3 cascade levels (10-byte UID); a tag
+                    // that keeps asserting the cascade bit would overflow data->uid[10].
+                    if(instance->col_res.cascade_level >= 2) {
+                        FURI_LOG_E(TAG, "Too many cascade levels");
+                        instance->state = Iso14443_3aPollerStateColResFailed;
+                        ret = Iso14443_3aErrorColResFailed;
+                        break;
+                    }
                     // UID incomplete: keep the 3 bytes after the cascade tag
                     memcpy(
                         &instance->data->uid[instance->data->uid_len],