diff --git a/wolfcrypt/src/pkcs12.c b/wolfcrypt/src/pkcs12.c
index eb38a2a3f..8e61aa4cc 100644
--- a/wolfcrypt/src/pkcs12.c
+++ b/wolfcrypt/src/pkcs12.c
@@ -1820,6 +1820,7 @@ static int wc_PKCS12_encrypt_content(WC_PKCS12* pkcs12, WC_RNG* rng,
         idx += SetObjectId(sizeof(WC_PKCS12_DATA_OID), out + idx);
         if (idx + sizeof(WC_PKCS12_DATA_OID) > *outSz){
             WOLFSSL_MSG("Buffer not large enough for DATA OID");
+            XFREE(tmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
             return BUFFER_E;
         }
         XMEMCPY(out + idx, WC_PKCS12_DATA_OID, sizeof(WC_PKCS12_DATA_OID));
@@ -1827,6 +1828,7 @@ static int wc_PKCS12_encrypt_content(WC_PKCS12* pkcs12, WC_RNG* rng,
 
         /* copy over encrypted data */
         if (idx + encSz > *outSz){
+            XFREE(tmp, heap, DYNAMIC_TYPE_TMP_BUFFER);
             return BUFFER_E;
         }
         XMEMCPY(out + idx, tmp, encSz);