diff --git a/Lib/test/test_codeccallbacks.py b/Lib/test/test_codeccallbacks.py
@@ -1100,6 +1100,21 @@ def test_encodehelper_bug36819(self):
             self.assertEqual(encoded[0].decode(), "abcdx" * 51)
             self.assertEqual(encoded[1], len(input))
 
+    def test_encode_backward_non_bmp(self):
+        # Characters re-encoded after a backward jump can take more
+        # space than a single code unit.
+        handler = RepeatedPosReturn("x")
+        codecs.register_error("test.backward_non_bmp", handler.handle)
+
+        input = "\U0001f40d" * 10 + "\udc80"
+        for enc in ("utf-8", "utf-16", "utf-16-le", "utf-16-be",
+                    "utf-32", "utf-32-le", "utf-32-be"):
+            with self.subTest(encoding=enc):
+                handler.count = 50
+                encoded = input.encode(enc, "test.backward_non_bmp")
+                self.assertEqual(encoded.decode(enc),
+                                 ("\U0001f40d" * 10 + "x") * 51)
+
     def test_translatehelper(self):
         # enhance coverage of:
         # Objects/unicodeobject.c::unicode_encode_call_errorhandler()

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-10-08-01-02-07.gh-issue-158925.XtDw_P.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-10-08-01-02-07.gh-issue-158925.XtDw_P.rst
@@ -0,0 +1,3 @@
+Fix a crash when encoding a string with non-BMP characters to UTF-16 with
+an error handler that returns a position before the error. Patch by
+Christian Aurich Zanettini Martins.
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
@@ -6478,6 +6478,10 @@ _PyUnicode_EncodeUTF16(PyObject *str,
             }
         }
         moreunits += pos - newpos;
+        if (newpos < pos && kind == PyUnicode_4BYTE_KIND) {
+            /* re-encoded characters may need a surrogate pair */
+            moreunits += pos - newpos;
+        }
         pos = newpos;
 
         /* two bytes are reserved for each surrogate */