diff --git a/src/main.c b/src/main.c
index ce362607..fb5c7ab8 100644
--- a/src/main.c
+++ b/src/main.c
@@ -612,6 +612,14 @@ int main(int argc, char* argv[]) {
       ret = JQ_ERROR_SYSTEM;
       goto out;
     }
+    int len = jv_string_length_bytes(jv_copy(data));
+    if ((size_t)len != strlen(jv_string_value(data))) {
+      fprintf(stderr, "jq: program file contains NUL bytes\n");
+      free(program_origin);
+      jv_free(data);
+      ret = JQ_ERROR_SYSTEM;
+      goto out;
+    }
     jq_set_attr(jq, jv_string("PROGRAM_ORIGIN"), jq_realpath(jv_string(dirname(program_origin))));
     ARGS = JV_OBJECT(jv_string("positional"), ARGS,
                      jv_string("named"), jv_copy(program_arguments));
diff --git a/tests/shtest b/tests/shtest
index 370f7b7c..68705df2 100755
--- a/tests/shtest
+++ b/tests/shtest
@@ -886,4 +886,11 @@ if printf '{}\x00{}' | $JQ >/dev/null 2> /dev/null; then
   exit 1
 fi
 
+# CVE-2026-41256: No NUL truncation in program files loaded with -f
+printf '.\x00invalid' > "$d/nul_prog.jq"
+if echo '42' | $JQ -f "$d/nul_prog.jq" >/dev/null 2>/dev/null; then
+  printf 'Error expected for program file with NUL bytes\n' 1>&2
+  exit 1
+fi
+
 exit 0