diff --git a/Modules/_json.c b/Modules/_json.c
--- a/Modules/_json.c
+++ b/Modules/_json.c
@@ -1495,6 +1495,16 @@
         PyErr_SetNone(PyExc_StopIteration);
         return NULL;
     }
+    if (idx == 0 && length >= 3 &&
+        str[0] == '\xef' &&
+        str[1] == '\xbb' &&
+        str[2] == '\xbf') {
+        /* UTF-8 BOM detected */
+        raise_errmsg("Unexpected UTF-8 BOM (decode using utf-8-sig)",
+                     pystr, idx);
+        return NULL;
+    }
+
     switch (str[idx]) {
         case '"':
             /* string */