diff --git a/reactos/subsystems/win32/win32k/ntuser/menu.c b/reactos/subsystems/win32/win32k/ntuser/menu.c
index 78299385a9d..88173f349aa 100644
--- a/reactos/subsystems/win32/win32k/ntuser/menu.c
+++ b/reactos/subsystems/win32/win32k/ntuser/menu.c
@@ -301,6 +301,7 @@ IntDestroyMenuObject(PMENU_OBJECT Menu,
          RemoveEntryList(&Menu->ListEntry);
       }
 
+      WindowStation = Menu->Process->Win32WindowStation;
       Status = ObReferenceObjectByHandle(Menu->Process->Win32WindowStation,
                                          0,
                                          ExWindowStationObjectType,
diff --git a/reactos/subsystems/win32/win32k/ntuser/window.c b/reactos/subsystems/win32/win32k/ntuser/window.c
index 27cc1abdeaf..fe1a78b6dbc 100644
--- a/reactos/subsystems/win32/win32k/ntuser/window.c
+++ b/reactos/subsystems/win32/win32k/ntuser/window.c
@@ -799,7 +799,6 @@ IntGetSystemMenu(PWINDOW_OBJECT Window, BOOL bRevert, BOOL RetMenu)
             ret = SysMenu;
          }
          IntDestroyMenuObject(Menu, FALSE, TRUE);
-         IntReleaseMenuObject(Menu);
       }
       if(RetMenu)
          return ret;