_com_error internaly uses "FormatMessage" with "FORMAT_MESSAGE_ALLOCATE_BUFFER" to get the error message for a specific error code.
If "FormatMessage" allocates the memory of the string, the called (in this case _com_error) must free this memory with "LocalFree". But the destructor frees the memory with "HeapFree" with the process heap. This is wrong and causes in memory-checking tools errors.
Until VS2003 then behavior was correct. The problem appears starting with VS2005.
See also previous bug in VS2008:
(It was promised to be solved in VS2008 SP1...)