diff --git a/Lib/plistlib.py b/Lib/plistlib.py
index 93f3ef5e38af843..5617e64161c8435 100644
--- a/Lib/plistlib.py
+++ b/Lib/plistlib.py
@@ -243,7 +243,8 @@ def end_dict(self):
         self.stack.pop()
 
     def end_key(self):
-        if self.current_key or not isinstance(self.stack[-1], dict):
+        if (self.current_key or not self.stack
+                or not isinstance(self.stack[-1], dict)):
             raise ValueError("unexpected key at line %d" %
                              self.parser.CurrentLineNumber)
         self.current_key = self.get_data()
diff --git a/Lib/test/test_plistlib.py b/Lib/test/test_plistlib.py
index b9c261310bb5670..d4543088f1f71d0 100644
--- a/Lib/test/test_plistlib.py
+++ b/Lib/test/test_plistlib.py
@@ -876,6 +876,12 @@ def test_invalidreal(self):
         self.assertRaises(ValueError, plistlib.loads,
                           b"<plist><integer>not real</integer></plist>")
 
+    def test_invalidkey(self):
+        for xml in (b"<plist><key>x</key></plist>",
+                    b'<?xml version="1.0"?><key>x</key>',
+                    b"<plist><array><key>x</key></array></plist>"):
+            self.assertRaises(ValueError, plistlib.loads, xml)
+
     def test_integer_notations(self):
         pl = b"<plist><integer>456</integer></plist>"
         value = plistlib.loads(pl)
diff --git a/Misc/NEWS.d/next/Library/2026-07-03-15-30-00.gh-issue-152959.Kx7Qm2.rst b/Misc/NEWS.d/next/Library/2026-07-03-15-30-00.gh-issue-152959.Kx7Qm2.rst
new file mode 100644
index 000000000000000..9640eafa7a8aa33
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-07-03-15-30-00.gh-issue-152959.Kx7Qm2.rst
@@ -0,0 +1,2 @@
+:mod:`plistlib` now raises :exc:`ValueError` for a ``<key>`` outside a
+``<dict>`` in an XML plist. Patch by tonghuaroot.