diff --git a/components/lwp/lwp_signal.c b/components/lwp/lwp_signal.c
index 8c88e68151e..99c55c84b7d 100644
--- a/components/lwp/lwp_signal.c
+++ b/components/lwp/lwp_signal.c
@@ -1114,6 +1114,16 @@ rt_err_t lwp_signal_action(struct rt_lwp *lwp, int signo,
     rt_list_t *thread_list;
     rt_err_t ret = RT_EOK;
 
+    /*
+     * Signal numbers are 1-based. valid_signo_check() accepts 0 for the
+     * kill(pid, 0) probe, so reject it here as well before using signo - 1
+     * to index sig_action[].
+     */
+    if (signo <= 0 || valid_signo_check(signo))
+    {
+        return -RT_EINVAL;
+    }
+
     if (lwp)
     {
         /** acquire READ access to lwp */
diff --git a/components/lwp/syscall/syscall_signal.c b/components/lwp/syscall/syscall_signal.c
index e0fb7459c14..cf2686b7ce7 100644
--- a/components/lwp/syscall/syscall_signal.c
+++ b/components/lwp/syscall/syscall_signal.c
@@ -50,6 +50,12 @@ sysret_t sys_sigaction(int sig, const struct k_sigaction *act,
     struct lwp_sigaction kact, *pkact = RT_NULL;
     struct lwp_sigaction koact, *pkoact = RT_NULL;
 
+    /* Reject out-of-range signal numbers before indexing the action arrays. */
+    if (sig <= 0 || (unsigned long)sig > _LWP_NSIG)
+    {
+        SET_ERRNO(EINVAL);
+        goto out;
+    }
     if (!sigsetsize)
     {
         SET_ERRNO(EINVAL);