diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c
index 77bbf986ff3..d71d2fa1bb8 100644
--- a/dlls/rpcrt4/ndr_marshall.c
+++ b/dlls/rpcrt4/ndr_marshall.c
@@ -7031,10 +7031,15 @@ static unsigned char *WINAPI NdrContextHandleUnmarshall(
 
     if (pStubMsg->IsClient)
     {
+        NDR_CCONTEXT *ccontext;
+        if (pFormat[1] & HANDLE_PARAM_IS_VIA_PTR)
+            ccontext = *(NDR_CCONTEXT **)ppMemory;
+        else
+            ccontext = (NDR_CCONTEXT *)ppMemory;
         /* [out]-only or [ret] param */
         if ((pFormat[1] & (HANDLE_PARAM_IS_IN|HANDLE_PARAM_IS_OUT)) == HANDLE_PARAM_IS_OUT)
-            **(NDR_CCONTEXT **)ppMemory = NULL;
-        NdrClientContextUnmarshall(pStubMsg, *(NDR_CCONTEXT **)ppMemory, pStubMsg->RpcMsg->Handle);
+            *ccontext = NULL;
+        NdrClientContextUnmarshall(pStubMsg, ccontext, pStubMsg->RpcMsg->Handle);
     }
     else
     {