CVE-2026-58458 Details
Description
Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.
A memory-corruption vulnerability has been identified in Klei Entertainment's game Don't Starve Together, specifically in the native persistent-string decoder. This vulnerability exists in the Steam version through build 747465. It allows remote attackers on public dedicated servers to crash the game clients of players who join their lobbies. The exploitation involves sending crafted world generation data that includes an invalid Klei persistent blob header length. When the victim views or selects the malicious public lobby, the game client decodes the attacker-controlled data, leading to corruption of native memory and causing a remote denial-of-service condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://kleiforums.com/game-updates/dst/ | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/don-t-starve-together-memory-corruption-via-world-gen-data | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Don't Starve Together | <= 747465 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |