How to Diagnose and Fix Windows 11 Explorer.exe Memory Leaks Using Sysinternals Process Explorer

Windows 11 Explorer.exe is consuming 25GB of idle RAM on your 32GB system after the January 2026 update. Task Manager shows it hovering at 600-700MB on a fresh boot, climbing relentlessly with every right-click and folder opened. Before that update, your system idled at 15GB total usage—now it chokes at 25GB with nothing running.

This isn't a random bug. This is a documented memory leak triggered by Windows 11 cumulative updates, including KB5055523 and KB5028254. The Explorer.exe process retains memory indefinitely, failing to release RAM after routine operations like right-clicking files or opening folders.

Info! This guide uses Sysinternals Process Explorer to identify root causes, apply registry tweaks, and implement permanent fixes—not temporary Band-Aids.

The Core Concepts: Why Explorer.exe Leaks Memory

Explorer.exe is more than a file manager—it's the Windows shell process responsible for the taskbar, desktop, Start menu, and all graphical file operations. When you right-click a file or open a folder that calls a shell extension, Explorer loads third-party DLLs into its process space.

Here's where the leak originates: Poorly coded shell extensions (context menu handlers, preview handlers, icon overlays) allocate memory but fail to release it when you close the folder or finish the operation. The January 2026 Windows 11 update exposed this behavior more aggressively—users on ElevenForum report Explorer jumping to 650MB+ after the update, where previously it stayed under 200MB.

Modern versions of Explorer use a multi-process architecture called File Explorer Tabs/Windows. Each File Explorer window spawns child processes under the main Explorer.exe. When these child processes malfunction, they fragment memory and leak handles. This is why Task Manager's simplified view only shows you the symptom—not the specific DLL or extension causing it.

Sysinternals Process Explorer differs from Task Manager because it exposes the full process tree, loaded DLLs, handle counts, and individual thread activity. You can see exactly which shell extension is hoarding memory.

Warning! Some malware disguises itself as Explorer.exe or injects into it. Always verify the file path is C:\Windows\explorer.exe before troubleshooting—anything else in AppData or Temp folders is suspicious.

Practical Step-by-Step Guide: Diagnose and Fix

Follow these exact steps to isolate and resolve the memory leak. This process takes approximately 20 minutes.

Step 1: Download and Launch Sysinternals Process Explorer

Download Process Explorer from Microsoft's official Sysinternals page:

1. Visit https://learn.microsoft.com/sysinternals/downloads/process-explorer

2. Extract procexp.exe to a permanent location (C:\Tools\ is recommended)

3. Right-click and select "Run as administrator"

Process Explorer requires elevation to inspect protected processes like Explorer.exe properly.

Step 2: Locate and Analyze Explorer.exe

1. Press Ctrl+F and type "explorer"

2. The top result is Explorer.exe (PID usually in the 1000s range)

3. Add these columns by right-clicking the header: Private Bytes, Working Set, Handles, Threads

Healthy Explorer.exe on Windows 11 24H2 typically runs at 100-300MB Private Bytes with under 5,000 handles. If you see 600MB+ or 15,000+ handles, you have a leak.

Step 3: Identify Memory-Hoarding Threads

1. Right-click Explorer.exe in Process Explorer

2. Select Properties → Threads tab

3. Sort by Cycles Delta or CPU to find active threads

Look for threads consuming CPU cycles even when File Explorer is idle. Note the Start Address—this shows the DLL responsible. Common culprits include:

- nvlddmkm.dll (NVIDIA graphics context menu)

- DropboxExt.dll (Dropbox overlay handler)

- OneDriveShell.dll (OneDrive shell extension)

- 7-Zip.dll (7-Zip context menu)

Step 4: Inspect Loaded DLLs

1. In Properties, go to the DLLs tab

2. Sort by Company Name to find third-party extensions

3. Look for unusual entries—anything from software you don't recognize

Info! Legitimate Windows DLLs are signed by "Microsoft Corporation." Unfamiliar vendors are often shell extensions causing leaks.

Step 5: Disable Offending Context Menu Handlers

Once you've identified the culprit DLL, disable it via registry or ShellExView:

1. Download NirSoft's ShellExView from https://www.nirsoft.net/utils/shexview.html

2. Run as administrator

3. Sort by Type and look for Context Menu

4. Disable entries from non-essential software by right-clicking → Disable Selected Items

Alternatively, manual registry edit (use with caution):

regedit
Navigate to: HKEY_CLASSES_ROOT\CLSID\{GUID}\InprocServer32
Export the key first, then delete or rename InprocServer32 to InprocServer32.bak

Step 6: Apply the Permanent Registry Fix

Disable Explorer's multi-process mode if you're on 24H2, which forces all Explorer windows into a single process:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SeparateProcess"=dword:00000001

Save as explorer_fix.reg, double-click to import, then restart Explorer:

taskkill /f /im explorer.exe & start explorer.exe

Troubleshooting & Pitfalls: When Fixes Fail

Problem: Memory still climbs after disabling shell extensions

The leak might be in a system component, not a third-party extension. Check for these specific Windows 11 bugs:

- KB5028254: Contains a known memory leak when right-clicking anywhere. Install KB5029351 or later which patches this.

- KB5055523: Causes Explorer to retain memory indefinitely. The fix is in KB5055623—check Windows Update.

Problem: Process Explorer shows svchost.exe consuming memory instead

The Desktop Window Manager (dwm.exe) or SearchIndexer can also leak. Check if the "Explorer" label in Task Manager actually points to a different PID. Use Process Explorer's Find Window's Process tool (target icon in toolbar) to click on the desktop—this confirms you're monitoring the correct process.

Problem: Restarting Explorer temporarily fixes it

This indicates a transient leak, likely caused by a specific operation. Reproduce the leak:

1. Note current memory usage in Process Explorer

2. Perform a suspected action (right-click 10 times, open 5 folders, scroll a large Downloads folder)

3. Check memory again

If memory jumps significantly and doesn't return, you've found the trigger.

Warning! Never disable Windows Explorer's shell extensions indiscriminately. Items labeled "Windows Explorer" or authored by Microsoft are essential. Only disable third-party extensions like WinRAR, Dropbox, or NVIDIA context menus.

Conclusion

Windows 11 Explorer.exe memory leaks aren't mysteries—they're diagnosable engineering problems with specific causes. Using Sysinternals Process Explorer, you can identify exactly which shell extension or DLL is hoarding RAM instead of guessing.

The January 2026 update made these leaks more visible, not more common. The underlying issue—poor memory management in third-party shell extensions—has existed for years. Apply the registry fix to disable multi-process mode, audit your context menu handlers monthly with ShellExView, and keep Windows updated with the latest cumulative patches.

Your system should idle under 15GB total RAM usage again. If it doesn't, you've got data now—use Process Explorer's details to identify the exact component and uninstall it.

Why does restarting Explorer.exe temporarily fix the memory leak?

Restarting Explorer.exe clears all allocated memory and resets the process state. However, this only addresses the symptom, not the cause. When you restart, Explorer reloads all shell extensions from scratch. The leak will recur when you perform the same action that triggered it initially—typically right-clicking files with a buggy context menu handler or opening folders with a memory-leaking preview extension installed.

How can I tell if my Explorer.exe high memory is caused by malware?

In Process Explorer, hover over the Explorer.exe entry and check the tooltip—it should show the path as C:\Windows\explorer.exe with a verified Microsoft signature. If the path points to AppData, Temp, or any unusual directory, it's malware. Additionally, check the Properties → Image tab for signature verification. Legitimate Windows processes are digitally signed by Microsoft Windows. Malware often disguises itself as Explorer.exe but fails signature checks and resides in user-writable directories.

Which Windows updates should I install to fix known Explorer.exe memory leaks?

Install KB5029351 or later to patch the right-click memory leak introduced in KB5028254. For the retention leak in KB5055523, install KB5055623. Always check Windows Update settings for the latest cumulative updates, as Microsoft regularly patches Explorer.exe issues. If you're experiencing leaks after the January 2026 update, KB5055623 specifically addresses memory retention failures when opening and closing File Explorer windows repeatedly.