diff --git a/src/main/java/org/apache/xmlbeans/impl/util/HexBin.java b/src/main/java/org/apache/xmlbeans/impl/util/HexBin.java
index aac10a6d1..292e5ca7d 100644
--- a/src/main/java/org/apache/xmlbeans/impl/util/HexBin.java
+++ b/src/main/java/org/apache/xmlbeans/impl/util/HexBin.java
@@ -25,7 +25,7 @@
  * </p>
  */
 public final class HexBin {
-    static private final int BASELENGTH = 255;
+    static private final int BASELENGTH = 256;
     static private final int LOOKUPLENGTH = 16;
     static private final byte[] hexNumberTable = new byte[BASELENGTH];
     static private final byte[] lookUpHexAlphabet = new byte[LOOKUPLENGTH];
diff --git a/src/test/java/misc/checkin/HexBinTest.java b/src/test/java/misc/checkin/HexBinTest.java
index 77218435c..ca0980c70 100644
--- a/src/test/java/misc/checkin/HexBinTest.java
+++ b/src/test/java/misc/checkin/HexBinTest.java
@@ -25,6 +25,7 @@
 import java.util.Locale;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
 
 public class HexBinTest {
 
@@ -36,6 +37,15 @@ void testSurrogate() throws Exception {
         assertEquals(exp, dec);
     }
 
+    @Test
+    void testInvalidHighByte() {
+        // 0xFF is not a hex digit; decode must report it like any other invalid
+        // input (null) instead of indexing past the lookup table.
+        assertNull(HexBin.decode(new byte[]{(byte) 0xFF, (byte) 0xFF}));
+        assertNull(HexBin.decode(new String(new byte[]{(byte) 0xFF, (byte) 0xFF},
+            StandardCharsets.ISO_8859_1)));
+    }
+
     @Test
     void knownValue() throws XPathException {
         // I've looked for comparison values but the following definition seems to be wrong,