diff --git a/electron/mediaServer.test.ts b/electron/mediaServer.test.ts
index b06587e9..cf6cd01b 100644
--- a/electron/mediaServer.test.ts
+++ b/electron/mediaServer.test.ts
@@ -72,6 +72,13 @@ describe("media server path policy", () => {
 });
 
 describe("resolveHttpByteRange", () => {
+	it("rejects malformed and multi-range headers", async () => {
+		const { resolveHttpByteRange } = await import("./mediaServer");
+
+		expect(resolveHttpByteRange("bytes=0-1,2-3", 100)).toBeNull();
+		expect(resolveHttpByteRange("bytes=0-1foo", 100)).toBeNull();
+	});
+
 	it("clamps oversized explicit end offsets to EOF", async () => {
 		const { resolveHttpByteRange } = await import("./mediaServer");
 
diff --git a/electron/mediaServer.ts b/electron/mediaServer.ts
index 41e1774d..c979a84e 100644
--- a/electron/mediaServer.ts
+++ b/electron/mediaServer.ts
@@ -12,7 +12,7 @@ export function resolveHttpByteRange(
 	rangeHeader: string,
 	fileSize: number,
 ): { start: number; end: number } | null {
-	const match = rangeHeader.match(/bytes=(\d*)-(\d*)/);
+	const match = rangeHeader.trim().match(/^bytes=(\d*)-(\d*)$/);
 	if (!match || (!match[1] && !match[2])) {
 		return null;
 	}