diff --git a/src/import/fuzz-qcow2.c b/src/import/fuzz-qcow2.c
new file mode 100644
index 0000000000..36f11b42e8
--- /dev/null
+++ b/src/import/fuzz-qcow2.c
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "fd-util.h"
+#include "fuzz.h"
+#include "memfd-util.h"
+#include "qcow2-util.h"
+
+/* systemd-importd runs this over images it just downloaded (see pull-raw.c), so the header, the L1/L2
+ * tables and every offset in them are attacker controlled. */
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+        _cleanup_close_ int qcow2_fd = -EBADF, raw_fd = -EBADF;
+
+        if (size < sizeof(uint32_t))
+                return 0;
+
+        fuzz_setup_logging();
+
+        qcow2_fd = memfd_new_and_seal("fuzz-qcow2-in", data, size);
+        if (qcow2_fd < 0)
+                return 0;
+
+        raw_fd = memfd_new("fuzz-qcow2-out");
+        if (raw_fd < 0)
+                return 0;
+
+        if (qcow2_detect(qcow2_fd) <= 0)
+                return 0;
+
+        (void) qcow2_convert(qcow2_fd, raw_fd);
+        return 0;
+}
diff --git a/src/import/meson.build b/src/import/meson.build
index a1ac50594f..a8fc08f855 100644
--- a/src/import/meson.build
+++ b/src/import/meson.build
@@ -93,6 +93,10 @@ executables += [
                 'sources' : files('test-oci-util.c'),
                 'import' : ['systemd-importd'],
         },
+        fuzz_template + {
+                'sources' : files('fuzz-qcow2.c'),
+                'import' : ['systemd-importd'],
+        },
 ]
 
 install_data('org.freedesktop.import1.conf',
diff --git a/test/fuzz/fuzz-qcow2/compressed-cluster b/test/fuzz/fuzz-qcow2/compressed-cluster
new file mode 100644
index 0000000000..caeb4733d5
Binary files /dev/null and b/test/fuzz/fuzz-qcow2/compressed-cluster differ
diff --git a/test/fuzz/fuzz-qcow2/plain-cluster b/test/fuzz/fuzz-qcow2/plain-cluster
new file mode 100644
index 0000000000..72fd329042
Binary files /dev/null and b/test/fuzz/fuzz-qcow2/plain-cluster differ