diff --git a/c/public/lib/source/cffread/cffread.c b/c/public/lib/source/cffread/cffread.c
index 25bc9684c..5ac83e076 100644
--- a/c/public/lib/source/cffread/cffread.c
+++ b/c/public/lib/source/cffread/cffread.c
@@ -961,7 +961,7 @@ static void saveBlend(cfrCtx h, float *realValue, abfOpEntry *blendEntry) {
         blendEntry->value = *realValue;
         blendEntry->numBlends = 0; /* shows there is no blend value, and the regular value shoud be used instead. */
         blendEntry->blendValues = NULL;
-    } else {
+    } else if (numBlends == 1) {
         int i;
         float defaultValue;
         signed int numRegions = h->stack.numRegions;
@@ -974,7 +974,7 @@ static void saveBlend(cfrCtx h, float *realValue, abfOpEntry *blendEntry) {
         // copy the defaul region value
         blendValues[0] = defaultValue = INDEX_REAL(0);
 
-        /* now, copy the blend abusolate values to blendArray[i].
+        /* now, copy the blend absolute values to blendArray[i].
         The default region value is in stackEntry->int_val or real_val
         The region delta values are in the stackEntry->blend_val array.
         */
@@ -982,7 +982,8 @@ static void saveBlend(cfrCtx h, float *realValue, abfOpEntry *blendEntry) {
         for (i = 0; i < numRegions; i++) {
             blendValues[i + 1] = stackEntry->blend_val[i] + defaultValue;
         }
-    }
+    } else
+        fatal(h, cfrErrDICTOp);
 }
 
 /* Save integer array operands. */
diff --git a/tests/tx_data/input/bad/bug940_private_blend.otf b/tests/tx_data/input/bad/bug940_private_blend.otf
new file mode 100644
index 000000000..7e3e90bb4
Binary files /dev/null and b/tests/tx_data/input/bad/bug940_private_blend.otf differ
diff --git a/tests/tx_test.py b/tests/tx_test.py
index 344c23782..96e5fd62b 100644
--- a/tests/tx_test.py
+++ b/tests/tx_test.py
@@ -841,3 +841,11 @@ def test_bad_charset():
     runner(CMD + ['-a', '-f', font_path, save_path])
     expected_path = get_expected_path('bad_charset.txt')
     assert differ([expected_path, save_path, '-s', '## Filename'])
+
+
+def test_bug_940():
+    input_path = get_bad_input_path('bug940_private_blend.otf')
+    output_path = get_temp_file_path()
+    with pytest.raises(subprocess.CalledProcessError) as err:
+        runner(CMD + ['-a', '-o', 'cff2', '-f', input_path, output_path])
+    assert(err.value.returncode > 0)  # error code, not segfault or success