diff --git a/src/arch/i386/image/pxe_image.c b/src/arch/i386/image/pxe_image.c
index 9e634f149..77fa0469a 100644
--- a/src/arch/i386/image/pxe_image.c
+++ b/src/arch/i386/image/pxe_image.c
@@ -84,6 +84,14 @@ int pxe_load ( struct image *image ) {
 	size_t memsz = image->len;
 	int rc;
 
+	/* Images too large to fit in base memory cannot be PXE
+	 * images.  We include this check to help prevent unrecognised
+	 * images from being marked as PXE images, since PXE images
+	 * have no signature we can check against.
+	 */
+	if ( filesz > ( 0xa0000 - 0x7c00 ) )
+		return -ENOEXEC;
+
 	/* There are no signature checks for PXE; we will accept anything */
 	if ( ! image->type )
 		image->type = &pxe_image_type;
diff --git a/src/hci/strerror.c b/src/hci/strerror.c
index 4fc15d01d..69675905e 100644
--- a/src/hci/strerror.c
+++ b/src/hci/strerror.c
@@ -118,4 +118,5 @@ struct errortab common_errors[] __errortab = {
 	{ ETIMEDOUT, "Connection timed out" },
 	{ EPIPE, "Broken pipe" },
 	{ ECANCELED, "Operation cancelled" },
+	{ ENOEXEC, "Not an executable image" },
 };