diff --git a/dlls/kernel/format_msg.c b/dlls/kernel/format_msg.c
index 3bc513d1edd..fe9f843c38f 100644
--- a/dlls/kernel/format_msg.c
+++ b/dlls/kernel/format_msg.c
@@ -468,7 +468,7 @@ DWORD WINAPI FormatMessageW(
                                 sprintf(fmtstr,"%%%s",f);
                                 f=x+1;
                             } else {
-                                fmtstr=HeapAlloc(GetProcessHeap(),0,strlen(f));
+                                fmtstr=HeapAlloc(GetProcessHeap(),0,strlen(f)+2);
                                 sprintf(fmtstr,"%%%s",f);
                                 f+=strlen(f); /*at \0*/
                             }