diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk
index 74e7d5da0779..645d720b2496 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -41,6 +41,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
         external/nss/nss.windows.patch \
         external/nss/nss.nowerror.patch \
         external/nss/nss.utf8bom.patch.1) \
+    external/nss/outofbounds.patch.0 \
 ))
 
 ifeq ($(COM_IS_CLANG),TRUE)
diff --git a/external/nss/outofbounds.patch.0 b/external/nss/outofbounds.patch.0
new file mode 100644
index 000000000000..f99bbb62119e
--- /dev/null
+++ b/external/nss/outofbounds.patch.0
@@ -0,0 +1,11 @@
+--- nss/lib/nss/nssinit.c
++++ nss/lib/nss/nssinit.c
+@@ -289,7 +289,7 @@
+
+     /* back up to the top of the directory */
+     PORT_Memcpy(path, dbpath, path_len);
+-    if (path[path_len - 1] != FILE_SEP) {
++    if (path_len == 0 || path[path_len - 1] != FILE_SEP) {
+         path[path_len++] = FILE_SEP;
+     }
+     PORT_Strcpy(&path[path_len], dllname);