diff --git a/src/ifcparse/IfcParse.cpp b/src/ifcparse/IfcParse.cpp
index badbfa8ba7..bc113112e2 100644
--- a/src/ifcparse/IfcParse.cpp
+++ b/src/ifcparse/IfcParse.cpp
@@ -1584,7 +1584,12 @@ void IfcParse::impl::in_memory_file_storage::read_from_stream(IfcParse::FileRead
         return;
     }
 
-    tokens = new IfcSpfLexer(s, logger());
+    // Owned via RAII so that any early return or exception while scanning
+    // the file (e.g. a malformed header, see fuzzer-z6u) still frees the
+    // lexer instead of leaking it; `tokens` itself stays a raw pointer since
+    // it's read by in_memory_file_storage::load() during the scan below.
+    std::unique_ptr<IfcSpfLexer> tokens_owner(new IfcSpfLexer(s, logger()));
+    tokens = tokens_owner.get();
 
     std::vector<std::string> schemas;
 
@@ -1689,7 +1694,8 @@ void IfcParse::impl::in_memory_file_storage::read_from_stream(IfcParse::FileRead
 
     logger().Status("\rDone scanning file   ");
 
-    delete tokens;
+    tokens_owner.reset();
+    tokens = nullptr;
 
     if (good_ != file_open_status::SUCCESS) {
         return;