diff --git a/drivers/mbimmodem/mbim-message.c b/drivers/mbimmodem/mbim-message.c
index 7899bc65..0c117658 100644
--- a/drivers/mbimmodem/mbim-message.c
+++ b/drivers/mbimmodem/mbim-message.c
@@ -153,8 +153,8 @@ static bool _iter_copy_string(struct mbim_message_iter *iter,
 					uint32_t offset, uint32_t len,
 					char **out)
 {
-	uint8_t buf[len];
-	uint8_t *dest = buf;
+	uint16_t buf[len / 2 + 1];
+	uint8_t *dest = (uint8_t *) buf;
 	uint32_t remaining = len;
 	uint32_t iov_start = 0;
 	uint32_t i = 0;
@@ -196,7 +196,7 @@ static bool _iter_copy_string(struct mbim_message_iter *iter,
 
 	/* Strings are in UTF16-LE, so convert to UTF16-CPU first if needed */
 	if (L_CPU_TO_LE16(0x8000) != 0x8000) {
-		uint16_t *le = (uint16_t *) buf;
+		uint16_t *le = buf;
 
 		for (i = 0; i < len / 2; i++)
 			le[i] = __builtin_bswap16(le[i]);