diff --git a/Lib/test/test_memoryio.py b/Lib/test/test_memoryio.py
index dcf6d51..13d7e17 100644
--- a/Lib/test/test_memoryio.py
+++ b/Lib/test/test_memoryio.py
@@ -452,6 +452,11 @@
         self.assertEqual(a.tobytes(), b"1234567890d")
         memio.close()
         self.assertRaises(ValueError, memio.readinto, b)
+        memio = self.ioclass(b"123")
+        b = bytearray()
+        memio.seek(42)
+        memio.readinto(b)
+        self.assertEqual(b, b"")
 
     def test_relative_seek(self):
         buf = self.buftype("1234567890")
diff --git a/Misc/NEWS b/Misc/NEWS
index 76bf481..7094504 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -24,6 +24,9 @@
 Library
 -------
 
+- Issue #10467: Fix BytesIO.readinto() after seeking into a position after the
+  end of the file.
+
 - Issue #1682942: configparser supports alternative option/value delimiters.
 
 - Issue #5412: configparser supports mapping protocol access.
diff --git a/Modules/_io/bytesio.c b/Modules/_io/bytesio.c
index c565404..b40513f 100644
--- a/Modules/_io/bytesio.c
+++ b/Modules/_io/bytesio.c
@@ -430,15 +430,20 @@
 bytesio_readinto(bytesio *self, PyObject *buffer)
 {
     void *raw_buffer;
-    Py_ssize_t len;
+    Py_ssize_t len, n;
 
     CHECK_CLOSED(self);
 
     if (PyObject_AsWriteBuffer(buffer, &raw_buffer, &len) == -1)
         return NULL;
 
-    if (self->pos + len > self->string_size)
-        len = self->string_size - self->pos;
+    /* adjust invalid sizes */
+    n = self->string_size - self->pos;
+    if (len > n) {
+        len = n;
+        if (len < 0)
+            len = 0;
+    }
 
     memcpy(raw_buffer, self->buf + self->pos, len);
     assert(self->pos + len < PY_SSIZE_T_MAX);