diff --git a/subsys/ipc/ipc_service/lib/Kconfig.icmsg b/subsys/ipc/ipc_service/lib/Kconfig.icmsg
index 7a9a93e86de..93427404dca 100644
--- a/subsys/ipc/ipc_service/lib/Kconfig.icmsg
+++ b/subsys/ipc/ipc_service/lib/Kconfig.icmsg
@@ -80,3 +80,11 @@ config PBUF
 	  with read/write semantics on top of a memory region shared by the
 	  reader and writer. It optionally embeds cache and memory barrier
 	  management to ensure correct data access.
+
+if PBUF
+
+config PBUF_RX_READ_BUF_SIZE
+	int "Size of PBUF read buffer in bytes"
+	default 128
+
+endif # PBUF
diff --git a/subsys/ipc/ipc_service/lib/icmsg.c b/subsys/ipc/ipc_service/lib/icmsg.c
index 73fac78fd69..e73bdaaa723 100644
--- a/subsys/ipc/ipc_service/lib/icmsg.c
+++ b/subsys/ipc/ipc_service/lib/icmsg.c
@@ -176,6 +176,7 @@ static void mbox_callback_process(struct icmsg_data_t *dev_data)
 #ifdef CONFIG_MULTITHREADING
 	struct icmsg_data_t *dev_data = CONTAINER_OF(item, struct icmsg_data_t, mbox_work);
 #endif
+	uint8_t rx_buffer[CONFIG_PBUF_RX_READ_BUF_SIZE] __aligned(4);
 
 	atomic_t state = atomic_get(&dev_data->state);
 
@@ -186,9 +187,13 @@ static void mbox_callback_process(struct icmsg_data_t *dev_data)
 		return;
 	}
 
-	uint8_t rx_buffer[len];
+	__ASSERT_NO_MSG(len <= sizeof(rx_buffer));
 
-	len = pbuf_read(dev_data->rx_pb, rx_buffer, len);
+	if (sizeof(rx_buffer) < len) {
+		return;
+	}
+
+	len = pbuf_read(dev_data->rx_pb, rx_buffer, sizeof(rx_buffer));
 
 	if (state == ICMSG_STATE_READY) {
 		if (dev_data->cb->received) {