diff --git a/dlls/oleaut32/usrmarshal.c b/dlls/oleaut32/usrmarshal.c
index 6ad9bd6d755..7409fcef19e 100644
--- a/dlls/oleaut32/usrmarshal.c
+++ b/dlls/oleaut32/usrmarshal.c
@@ -552,14 +552,29 @@ unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffe
 
     if(header->vt & VT_BYREF)
     {
+        ULONG mem_size;
         Pos += 4;
+
+        switch (header->vt & ~VT_BYREF)
+        {
+        /* these types have a different memory size compared to wire size */
+        case VT_UNKNOWN:
+        case VT_DISPATCH:
+        case VT_BSTR:
+            mem_size = sizeof(void *);
+            break;
+        default:
+            mem_size = type_size;
+            break;
+        }
+
         if (V_VT(pvar) != header->vt)
         {
             VariantClear(pvar);
-            V_BYREF(pvar) = CoTaskMemAlloc(type_size);
+            V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
         }
         else if (!V_BYREF(pvar))
-            V_BYREF(pvar) = CoTaskMemAlloc(type_size);
+            V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
         memcpy(V_BYREF(pvar), Pos, type_size);
         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
             Pos += type_size;