Live › vulnerability › CVE-2026-58458
Go to dashboardDon't Starve Together builds through 747465 have a memory-corruption bug in the native persistent-string decoder. A malicious public server can publish crafted world_gen_data that corrupts client memory and crashes a player's game when they view or select the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Players running Don't Starve Together builds through 747465 who browse or join public dedicated servers are exposed, since the crash is triggered by the malicious server listing's data when viewed or selected. Players who only play private or local games with trusted hosts are unlikely to encounter it. The sources do not describe any server-side exposure for hosts.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-58458")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.