diff --git a/reactos/subsys/system/services/config.c b/reactos/subsys/system/services/config.c
index 8e23f92df73..24c0138673b 100644
--- a/reactos/subsys/system/services/config.c
+++ b/reactos/subsys/system/services/config.c
@@ -269,7 +269,7 @@ ScmReadString(HKEY hServiceKey,
             dwError = GetLastError();
             goto done;
         }
-        expanded = HeapAlloc(GetProcessHeap(), 0, dwSizeNeeded);
+        expanded = HeapAlloc(GetProcessHeap(), 0, dwSizeNeeded * sizeof(WCHAR));
         if (dwSizeNeeded < ExpandEnvironmentStringsW((LPCWSTR)ptr, expanded, dwSizeNeeded))
         {
             dwError = GetLastError();