diff --git a/Core/Libraries/Source/WWVegas/WW3D2/htree.cpp b/Core/Libraries/Source/WWVegas/WW3D2/htree.cpp
index fc64894f36b..34439152ede 100644
--- a/Core/Libraries/Source/WWVegas/WW3D2/htree.cpp
+++ b/Core/Libraries/Source/WWVegas/WW3D2/htree.cpp
@@ -200,6 +200,10 @@ int HTreeClass::Load_W3D(ChunkLoadClass & cload)
 	*/
 	bool pre30 = false;
 	if (header.Version < W3D_MAKE_VERSION(3,0)) {
+		// TheSuperHackers @fix CryoTheRenegade 24/08/2026 Reject UINT32_MAX pivot counts so the pre-3.0 increment cannot wrap to zero, skip allocation, and then write Pivot[0].
+		if (header.NumPivots == 0xffffffffu) {
+			return LOAD_ERROR;
+		}
 		header.NumPivots ++;
 		pre30 = true;
 	}
@@ -267,6 +271,9 @@ bool HTreeClass::read_pivots(ChunkLoadClass & cload,bool pre30)
 	** this so we just put one in.
 	*/
 	if (pre30) {
+		if (Pivot == nullptr || NumPivots < 1) {
+			return false;
+		}
 		Pivot[0].Index = 0;
 		Pivot[0].Parent = nullptr;
 		Pivot[0].BaseTransform.Make_Identity();