diff --git a/src/transport/raw/MessageHeader.cpp b/src/transport/raw/MessageHeader.cpp
index 77474cf9941c01..07cc5a1a18f1d7 100644
--- a/src/transport/raw/MessageHeader.cpp
+++ b/src/transport/raw/MessageHeader.cpp
@@ -202,6 +202,16 @@ CHIP_ERROR PacketHeader::Decode(const uint8_t * const data, uint16_t size, uint1
         mDestinationGroupId.ClearValue();
     }
 
+    if (mSecFlags.Has(Header::SecFlagValues::kMsgExtensionFlag))
+    {
+        // If present, skip over Message Extension block.
+        // Spec 4.4.1.8. Message Extensions (variable)
+        uint16_t mxLength;
+        SuccessOrExit(err = reader.Read16(&mxLength).StatusCode());
+        VerifyOrExit(mxLength <= reader.Remaining(), err = CHIP_ERROR_INTERNAL);
+        reader.Skip(mxLength);
+    }
+
     octets_read = static_cast<uint16_t>(reader.OctetsRead());
     VerifyOrExit(octets_read == EncodeSizeBytes(), err = CHIP_ERROR_INTERNAL);
     *decode_len = octets_read;
@@ -258,6 +268,16 @@ CHIP_ERROR PayloadHeader::Decode(const uint8_t * const data, uint16_t size, uint
         mAckMessageCounter.ClearValue();
     }
 
+    if (mExchangeFlags.Has(Header::ExFlagValues::kExchangeFlag_SecuredExtension))
+    {
+        // If present, skip over Secured Extension block.
+        // Spec 4.4.3.7. Secured Extensions (variable)
+        uint16_t sxLength;
+        SuccessOrExit(err = reader.Read16(&sxLength).StatusCode());
+        VerifyOrExit(sxLength <= reader.Remaining(), err = CHIP_ERROR_INTERNAL);
+        reader.Skip(sxLength);
+    }
+
     octets_read = static_cast<uint16_t>(reader.OctetsRead());
     VerifyOrExit(octets_read == EncodeSizeBytes(), err = CHIP_ERROR_INTERNAL);
     *decode_len = octets_read;
diff --git a/src/transport/raw/MessageHeader.h b/src/transport/raw/MessageHeader.h
index 60255f78d19629..f253aa4f928751 100644
--- a/src/transport/raw/MessageHeader.h
+++ b/src/transport/raw/MessageHeader.h
@@ -71,6 +71,9 @@ enum class ExFlagValues : uint8_t
     /// Set when current message is requesting an acknowledgment from the recipient.
     kExchangeFlag_NeedsAck = 0x04,
 
+    /// Secured Extension block is present.
+    kExchangeFlag_SecuredExtension = 0x08,
+
     /// Set when a vendor id is prepended to the Message Protocol Id field.
     kExchangeFlag_VendorIdPresent = 0x10,
 };