diff --git a/Lib/test/test_interpreters/test_api.py b/Lib/test/test_interpreters/test_api.py
index 13d23af5aceb47..4ccb1922dadd33 100644
--- a/Lib/test/test_interpreters/test_api.py
+++ b/Lib/test/test_interpreters/test_api.py
@@ -117,6 +117,13 @@ def test_in_main(self):
         # GH-126221: Passing an invalid Unicode character used to cause a SystemError
         self.assertRaises(UnicodeEncodeError, _interpreters.create, '\udc80')
 
+    def test_config_with_surrogate_str_field(self):
+        # gh-148798: a config whose string field contains an unpaired
+        # surrogate used to crash the interpreter. It must raise instead.
+        config = _interpreters.new_config()
+        config.gil = 'own\udc80'
+        self.assertRaises(UnicodeEncodeError, _interpreters.create, config)
+
     def test_in_thread(self):
         lock = threading.Lock()
         interp = None
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-20-01-45-00.gh-issue-148798.interpconfig.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-20-01-45-00.gh-issue-148798.interpconfig.rst
new file mode 100644
index 00000000000000..e951b81752a821
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-20-01-45-00.gh-issue-148798.interpconfig.rst
@@ -0,0 +1,4 @@
+Fix a crash in :func:`!_interpreters.create` when a config value contains
+a string with an unpaired surrogate. :c:func:`PyUnicode_AsUTF8` returned
+``NULL`` and the result was passed to :c:func:`!strncpy`, dereferencing
+it. The caller now propagates the :exc:`UnicodeEncodeError` instead.
diff --git a/Python/interpconfig.c b/Python/interpconfig.c
index a37bd3f5b23a01..6e5fc807641df0 100644
--- a/Python/interpconfig.c
+++ b/Python/interpconfig.c
@@ -133,7 +133,12 @@ _config_dict_copy_str(PyObject *dict, const char *name,
         config_dict_invalid_type(name);
         return -1;
     }
-    strncpy(buf, PyUnicode_AsUTF8(item), bufsize-1);
+    const char *utf8 = PyUnicode_AsUTF8(item);
+    if (utf8 == NULL) {
+        Py_DECREF(item);
+        return -1;
+    }
+    strncpy(buf, utf8, bufsize-1);
     buf[bufsize-1] = '\0';
     Py_DECREF(item);
     return 0;