diff --git a/dlls/xmllite/reader.c b/dlls/xmllite/reader.c
index a11ec7a45a4..e7b8364b450 100644
--- a/dlls/xmllite/reader.c
+++ b/dlls/xmllite/reader.c
@@ -409,6 +409,7 @@ static void reader_clear_attrs(xmlreader *reader)
     LIST_FOR_EACH_ENTRY_SAFE(attr, attr2, &reader->attrs, struct attribute, entry)
     {
         reader_free_strvalued(reader, &attr->localname);
+        reader_free_strvalued(reader, &attr->value);
         reader_free(reader, attr);
     }
     list_init(&reader->attrs);
@@ -428,6 +429,12 @@ static HRESULT reader_add_attr(xmlreader *reader, strval *prefix, strval *localn
     if (!attr) return E_OUTOFMEMORY;
 
     hr = reader_strvaldup(reader, localname, &attr->localname);
+    if (hr == S_OK)
+    {
+        hr = reader_strvaldup(reader, value, &attr->value);
+        if (hr != S_OK)
+            reader_free_strvalued(reader, &attr->value);
+    }
     if (hr != S_OK)
     {
         reader_free(reader, attr);
@@ -439,7 +446,6 @@ static HRESULT reader_add_attr(xmlreader *reader, strval *prefix, strval *localn
     else
         memset(&attr->prefix, 0, sizeof(attr->prefix));
     attr->qname = qname ? *qname : *localname;
-    attr->value = *value;
     attr->position = *position;
     attr->flags = flags;
     list_add_tail(&reader->attrs, &attr->entry);
@@ -3303,7 +3309,7 @@ static const strval *reader_get_value(xmlreader *reader, BOOL ensure_allocated)
 
             return &ns->uri;
         }
-        break;
+        return &reader->attr->value;
     default:
         break;
     }
diff --git a/dlls/xmllite/tests/reader.c b/dlls/xmllite/tests/reader.c
index fd835695230..ea163de92a1 100644
--- a/dlls/xmllite/tests/reader.c
+++ b/dlls/xmllite/tests/reader.c
@@ -2483,7 +2483,7 @@ static void test_reader_position(void)
 
 static void test_string_pointers(void)
 {
-    const WCHAR *ns, *nsq, *empty, *xmlns_ns, *xmlns_name, *name, *p, *q, *xml, *ptr;
+    const WCHAR *ns, *nsq, *empty, *xmlns_ns, *xmlns_name, *name, *p, *q, *xml, *ptr, *value;
     IXmlReader *reader;
     HRESULT hr;
 
@@ -2592,10 +2592,12 @@ static void test_string_pointers(void)
     read_node(reader, XmlNodeType_Element);
     next_attribute(reader);
     name = reader_name(reader, "attr");
+    value = reader_value(reader, "value");
 
     move_to_element(reader);
     next_attribute(reader);
     ok(name == reader_name(reader, "attr"), "attr pointer changed\n");
+    ok(value == reader_value(reader, "value"), "value pointer changed\n");
 
     IXmlReader_Release(reader);
 }