diff --git a/dlls/crypt32/chain.c b/dlls/crypt32/chain.c
index 068e039dd62..53588f8fbb8 100644
--- a/dlls/crypt32/chain.c
+++ b/dlls/crypt32/chain.c
@@ -913,6 +913,10 @@ static BOOL CRYPT_BuildSimpleChain(PCertificateChainEngine engine,
         if (issuer)
         {
             ret = CRYPT_AddCertToSimpleChain(engine, chain, issuer, infoStatus);
+            /* CRYPT_AddCertToSimpleChain add-ref's the issuer, so free it to
+             * close the enumeration that found it
+             */
+            CertFreeCertificateContext(issuer);
             cert = issuer;
         }
         else