https://bugs.winehq.org/show_bug.cgi?id=42023
--- Comment #5 from Zebediah Figura z.figura12@gmail.com --- IStorage16_fnOpenStorage had (apparently due to a copyerror) assigned an *IStream16Impl to an *IStorage16Impl and written over the last element, thus trashing the heap.
I've submitted a patch to fix this: https://source.winehq.org/patches/data/129282