diff --git a/components/lwp/lwp_signal.c b/components/lwp/lwp_signal.c
index 8c88e68151ee..7c8b746bbd9c 100644
--- a/components/lwp/lwp_signal.c
+++ b/components/lwp/lwp_signal.c
@@ -1114,6 +1114,12 @@ rt_err_t lwp_signal_action(struct rt_lwp *lwp, int signo,
     rt_list_t *thread_list;
     rt_err_t ret = RT_EOK;
 
+    /* Signal numbers are 1-based, reject out-of-range values before indexing */
+    if (signo <= 0 || valid_signo_check(signo))
+    {
+        return -RT_EINVAL;
+    }
+
     if (lwp)
     {
         /** acquire READ access to lwp */
diff --git a/components/lwp/lwp_syscall.c b/components/lwp/lwp_syscall.c
index a871f71b513e..c36464cd95c3 100644
--- a/components/lwp/lwp_syscall.c
+++ b/components/lwp/lwp_syscall.c
@@ -6752,6 +6752,11 @@ sysret_t sys_sigaction(int sig, const struct k_sigaction *act,
     struct lwp_sigaction kact, *pkact = RT_NULL;
     struct lwp_sigaction koact, *pkoact = RT_NULL;
 
+    if (sig <= 0 || (unsigned long)sig > _LWP_NSIG)
+    {
+        SET_ERRNO(EINVAL);
+        goto out;
+    }
     if (!sigsetsize)
     {
         SET_ERRNO(EINVAL);