diff --git a/reactos/subsystems/win32/win32k/ntuser/callback.c b/reactos/subsystems/win32/win32k/ntuser/callback.c
index eb4db061d10..0bcbaf2727c 100644
--- a/reactos/subsystems/win32/win32k/ntuser/callback.c
+++ b/reactos/subsystems/win32/win32k/ntuser/callback.c
@@ -267,7 +267,16 @@ co_IntLoadSysMenuTemplate()
    if (NT_SUCCESS(Status))
    {
       /* Simulate old behaviour: copy into our local buffer */
-      Result = *(LRESULT*)ResultPointer;
+      _SEH2_TRY
+      {
+        ProbeForRead(ResultPointer, sizeof(LRESULT), 1);
+        Result = *(LRESULT*)ResultPointer;
+      }
+      _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+      {
+        Result = 0;
+      }
+      _SEH2_END
    }
 
    UserEnterCo();