CVE-2026-58458
Don't Starve Together Memory Corruption via world_gen_data
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.
| CWE | CWE-787 |
| Vendor | klei entertainment |
| Product | don't starve together |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for klei entertainment don't starve together
Be the first to know when new medium vulnerabilities affecting klei entertainment don't starve together are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Klei Entertainment / Don't Starve Together
0 ≤ 747465
References
Credits
CuB3y0nd