diff --git a/programs/compressed-token/program/src/compressed_token/transfer2/token_inputs.rs b/programs/compressed-token/program/src/compressed_token/transfer2/token_inputs.rs
index 2416f51153..f22e939936 100644
--- a/programs/compressed-token/program/src/compressed_token/transfer2/token_inputs.rs
+++ b/programs/compressed-token/program/src/compressed_token/transfer2/token_inputs.rs
@@ -28,6 +28,7 @@ pub fn set_input_compressed_accounts<'a>(
 ) -> Result<[Option<u8>; MAX_COMPRESSIONS], ProgramError> {
     // compression_to_input[compression_index] = Some(input_index), None means unset
     let mut compression_to_input: [Option<u8>; MAX_COMPRESSIONS] = [None; MAX_COMPRESSIONS];
+    let compressions_len = inputs.compressions.as_ref().map(|c| c.len()).unwrap_or(0);
 
     for (i, input_data) in inputs.in_token_data.iter().enumerate() {
         let input_lamports = if let Some(lamports) = inputs.in_lamports.as_ref() {
@@ -57,6 +58,10 @@ pub fn set_input_compressed_accounts<'a>(
                     if idx >= MAX_COMPRESSIONS {
                         return Err(TokenError::CompressionIndexOutOfBounds.into());
                     }
+                    // Check compression_index is within actual compressions length
+                    if idx >= compressions_len {
+                        return Err(TokenError::CompressionIndexOutOfBounds.into());
+                    }
                     // Check uniqueness - error if compression_index already used
                     if compression_to_input[idx].is_some() {
                         return Err(TokenError::DuplicateCompressionIndex.into());