diff --git a/src/Text.cpp b/src/Text.cpp
index 038553ba44..308348595d 100644
--- a/src/Text.cpp
+++ b/src/Text.cpp
@@ -1745,20 +1745,24 @@ bool Text::dissolveInset(Cursor & cur)
 	cur.recordUndoInset();
 	cur.setMark(false);
 	cur.selHandle(false);
-	// save position
+	// save position inside inset
 	pos_type spos = cur.pos();
 	pit_type spit = cur.pit();
 	ParagraphList plist;
 	if (cur.lastpit() != 0 || cur.lastpos() != 0)
 		plist = paragraphs();
 	cur.popBackward();
-	// store cursor offset
+	// update cursor offset
 	if (spit == 0)
 		spos += cur.pos();
 	spit += cur.pit();
-	Buffer & b = *cur.buffer();
-	cur.paragraph().eraseChar(cur.pos(), b.params().track_changes);
+	// remember position outside inset to delete inset later
+	// we do not do it now to avoid memory reuse issues (see #10667).
+	DocIterator inset_it = cur;
+	// jump over inset
+	++cur.pos();
 
+	Buffer & b = *cur.buffer();
 	if (!plist.empty()) {
 		// see bug 7319
 		// we clear the cache so that we won't get conflicts with labels
@@ -1784,6 +1788,9 @@ bool Text::dissolveInset(Cursor & cur)
 		cur.pos() = min(cur.lastpos(), spos);
 	}
 
+	// delete the inset now
+	inset_it.paragraph().eraseChar(inset_it.pos(), b.params().track_changes);
+
 	cur.forceBufferUpdate();
 
 	// Ensure the current language is set correctly (bug 6292)