diff --git a/src/CertManager.sol b/src/CertManager.sol
index 54049cb..0841230 100644
--- a/src/CertManager.sol
+++ b/src/CertManager.sol
@@ -555,7 +555,9 @@ contract CertManager is ICertManager {
 
             if (certificate[basicConstraintsPtr.header()] == 0x02) {
                 if (basicConstraintsPtr.length() == 0) revert InvalidBasicConstraints();
-                maxPathLen = int64(uint64(certificate.uintAt(basicConstraintsPtr)));
+                uint256 pathLen = certificate.uintAt(basicConstraintsPtr);
+                if (pathLen > uint256(uint64(type(int64).max))) revert InvalidBasicConstraints();
+                maxPathLen = int64(uint64(pathLen));
             } else {
                 revert InvalidBasicConstraints();
             }
diff --git a/test/CertManager.t.sol b/test/CertManager.t.sol
index 6db1293..48c9d71 100644
--- a/test/CertManager.t.sol
+++ b/test/CertManager.t.sol
@@ -99,6 +99,18 @@ contract CertManagerTest is Test {
         assertEq(int256(certManagerHarness.verifyBasicConstraints(hex"30060101ff020100", true)), 0);
     }
 
+    function test_BasicConstraintsAcceptsMaxInt64PathLen() public view {
+        assertEq(
+            int256(certManagerHarness.verifyBasicConstraints(hex"300d0101ff02087fffffffffffffff", true)),
+            int256(type(int64).max)
+        );
+    }
+
+    function test_BasicConstraintsRejectsPathLenAboveInt64Max() public {
+        vm.expectRevert(CertManager.InvalidBasicConstraints.selector);
+        certManagerHarness.verifyBasicConstraints(hex"300e0101ff0209008000000000000000", true);
+    }
+
     function test_BasicConstraintsRejectsEmptyPathLen() public {
         vm.expectRevert(CertManager.InvalidBasicConstraints.selector);
         certManagerHarness.verifyBasicConstraints(hex"30050101ff0200", true);