diff --git a/lib/forwardanalyzer.cpp b/lib/forwardanalyzer.cpp
index 727c64b076d..ced1cfbda8d 100644
--- a/lib/forwardanalyzer.cpp
+++ b/lib/forwardanalyzer.cpp
@@ -395,6 +395,11 @@ namespace {
                 bool structuralUnknown = false;
                 const bool structuralEscape = isEscapeScope(branch.endBlock, structuralUnknown);
                 branch.escapeUnknown = !structuralEscape || structuralUnknown;
+                // The traversal stopped at the escape, so the rest of the scope was not walked; a
+                // fall-through path could still modify the value there - include the whole scope's
+                // actions so isModified() sees it.
+                if (branch.escapeUnknown)
+                    branch.action |= analyzeScope(branch.endBlock);
             } else {
                 // Detect an escape the traversal did not flag (e.g. an unknown noreturn call);
                 // escapeUnknown reports a possible (unknown) escape.
diff --git a/test/testvalueflow.cpp b/test/testvalueflow.cpp
index 888710ce57d..8a0d181900d 100644
--- a/test/testvalueflow.cpp
+++ b/test/testvalueflow.cpp
@@ -3214,6 +3214,38 @@ class TestValueFlow : public TestFixture {
                "    return x;\n"
                "}\n";
         ASSERT_EQUALS(true, testValueOfXKnown(code, 3U, 0));
+
+        code = "bool f();\n" // a modification after a conditional escape must still be seen
+               "void g() {\n"
+               "    bool x = false;\n"
+               "    if (f()) {\n"
+               "        if (f()) return;\n"
+               "        if (f()) x = true;\n"
+               "    }\n"
+               "    if (x) {}\n"
+               "}\n";
+        ASSERT_EQUALS(true, testValueOfX(code, 8U, 0));
+        ASSERT_EQUALS(false, testValueOfXKnown(code, 8U, 0));
+
+        code = "bool f();\n"
+               "void g() {\n"
+               "    bool x = false;\n"
+               "    if (f()) {\n"
+               "        if (f()) return;\n"
+               "        x = true;\n"
+               "    }\n"
+               "    if (x) {}\n"
+               "}\n";
+        ASSERT_EQUALS(true, testValueOfX(code, 8U, 0));
+        ASSERT_EQUALS(false, testValueOfXKnown(code, 8U, 0));
+
+        code = "bool f();\n" // the branch always escapes - keep the known value
+               "void g() {\n"
+               "    bool x = false;\n"
+               "    if (f()) { x = true; return; }\n"
+               "    if (x) {}\n"
+               "}\n";
+        ASSERT_EQUALS(true, testValueOfXKnown(code, 5U, 0));
     }
 
     void valueFlowAfterSwap()