In the native implementation that handles EnumVariants there are two memory leaks.
The first one is in Variant.cpp where there is an extra AddRef (which must not be there because a previous QueryInterface call already incremented the reference).
The second one is in EnumVariant.cpp where a VariantClear call is missing. According to MS documentation, Variants received while iterating IEnumVARIANT must be cleared when no longer needed. The Variant value is copied in EnumVariant.cpp (which itself could probably be optimized - maybe I'll look at this later). After that, the original value is no longer needed, so it must be cleared.
I've performed some tests, and both are actual leaks, not just theoretical ones. The attached patch (against release 1.11.1) fixes them (also reported as bugs 1112667, 1465539, and 1569864).