diff --git a/Lib/test/test_multibytecodec.py b/Lib/test/test_multibytecodec.py
@@ -265,6 +265,15 @@ def test_iso2022(self):
         self.assertRaises(UnicodeDecodeError, decoder.decode, b'', True)
         self.assertEqual(decoder.decode(b'B@$'), '\u4e16')
 
+    def test_hz_keep_buffer(self):
+        # A trailing '~' shouldn't read past the end of the input.
+        decoder = codecs.getincrementaldecoder('hz')()
+        self.assertEqual(decoder.decode(b'~'), '')
+        self.assertRaises(UnicodeDecodeError, decoder.decode, b'', True)
+        self.assertEqual(decoder.decode(b'~'), '~')
+        self.assertEqual(decoder.decode(b'~'), '')
+        self.assertEqual(decoder.decode(b'\n', True), '')
+
     def test_decode_unicode(self):
         # Trying to decode a unicode string should raise a TypeError
         for enc in ALL_CJKENCODINGS:

diff --git a/Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst b/Misc/NEWS.d/next/Library/2026-09-11-16-50-11.gh-issue-157325.hzTild.rst
@@ -0,0 +1,2 @@
+Fix an out-of-bounds read in the ``hz`` incremental decoder when the input
+ends with ``~``.
@@ -414,9 +414,9 @@ DECODER(hz)
         Py_UCS4 decoded;
 
         if (c == '~') {
+            REQUIRE_INBUF(2);
             unsigned char c2 = INBYTE2;
 
-            REQUIRE_INBUF(2);
             if (c2 == '~' && state->c[CN_STATE_OFFSET] == 0)
                 OUTCHAR('~');
             else if (c2 == '{' && state->c[CN_STATE_OFFSET] == 0)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Fix an out-of-bounds read in the ``hz`` incremental decoder when the input
		ends with ``~``.