diff -r b898402e75ef Lib/plistlib.py
--- a/Lib/plistlib.py	Mon May 19 07:34:08 2014 +0100
+++ b/Lib/plistlib.py	Tue May 20 09:08:05 2014 +0300
@@ -619,10 +619,7 @@
                 offset_table_offset
             ) = struct.unpack('>6xBBQQQ', trailer)
             self._fp.seek(offset_table_offset)
-            offset_format = '>' + _BINARY_FORMAT[offset_size] * num_objects
-            self._ref_format = _BINARY_FORMAT[self._ref_size]
-            self._object_offsets = struct.unpack(
-                offset_format, self._fp.read(offset_size * num_objects))
+            self._object_offsets = self._read_ints(num_objects, offset_size)
             return self._read_object(self._object_offsets[top_object])
 
         except (OSError, IndexError, struct.error):
@@ -638,9 +635,16 @@
 
         return tokenL
 
+    def _read_ints(self, n, size):
+        data = self._fp.read(size * n)
+        if size in _BINARY_FORMAT:
+            return struct.unpack('>' + _BINARY_FORMAT[size] * n, data)
+        else:
+            return tuple(int.from_bytes(data[i: i + size], 'big')
+                         for i in range(0, size * n, size))
+
     def _read_refs(self, n):
-        return struct.unpack(
-            '>' + self._ref_format * n, self._fp.read(n * self._ref_size))
+        return self._read_ints(n, self._ref_size)
 
     def _read_object(self, offset):
         """
diff -r b898402e75ef Lib/test/test_plistlib.py
--- a/Lib/test/test_plistlib.py	Mon May 19 07:34:08 2014 +0100
+++ b/Lib/test/test_plistlib.py	Tue May 20 09:08:05 2014 +0300
@@ -411,6 +411,18 @@
                 pl2 = plistlib.loads(data)
                 self.assertEqual(dict(pl), dict(pl2))
 
+    def test_nonstandard_refs_size(self):
+        # Issue #21538: Refs and offsets are 24-bit integers
+        data = (b'bplist00'
+                b'\xd1\x00\x00\x01\x00\x00\x02QaQb'
+                b'\x00\x00\x08\x00\x00\x0f\x00\x00\x11'
+                b'\x00\x00\x00\x00\x00\x00'
+                b'\x03\x03'
+                b'\x00\x00\x00\x00\x00\x00\x00\x03'
+                b'\x00\x00\x00\x00\x00\x00\x00\x00'
+                b'\x00\x00\x00\x00\x00\x00\x00\x13')
+        self.assertEqual(plistlib.loads(data), {'a': 'b'})
+
 
 class TestPlistlibDeprecated(unittest.TestCase):
     def test_io_deprecated(self):