{"id":"CVE-2026-58458","kind":"vulnerability","aliases":["CVE-2026-58458"],"related":[],"title":"Don't Starve Together: malformed server data crashes game client remotely","description":"Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.","summary":"Don't Starve Together builds through 747465 have a memory-corruption bug in the native persistent-string decoder. A malicious public server can publish crafted world_gen_data that corrupts client memory and crashes a player's game when they view or select the server.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dont-starve-together","game-clients","other","steam"],"not_affected_if":["no-public-server-browsing","private-games-only"],"how_to_check":"- Check the installed Don't Starve Together build number in the Steam client or game files; unknown if the sources give a fixed build\n- Confirm whether the game is installed on the machine (Steam AppID 322330)","fix":"- Update Don't Starve Together through Steam to a build newer than 747465; the exact fixed build is unknown from the sources\n- Avoid joining or browsing untrusted public servers until updated","status":"open","published_at":"2026-10-28T18:17:20+00:00","first_seen_at":"2026-10-28T18:34:34+00:00","triaged_at":"2026-10-28T18:34:55+00:00","updated_at":"2026-10-28T18:34:55+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-28T18:34:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update Don't Starve Together through Steam to a build newer than 747465; the exact fixed build is unknown from the sources\n- Avoid joining or browsing untrusted public servers until updated","reach":"internet","title":"Don't Starve Together: malformed server data crashes game client remotely","impact":"low","summary":"Don't Starve Together builds through 747465 have a memory-corruption bug in the native persistent-string decoder. A malicious public server can publish crafted world_gen_data that corrupts client memory and crashes a player's game when they view or select the server.","category":"other","nicknames":[],"who_cares":["steam","game-clients","dont-starve-together"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote crash of the player's game client","analyst_note":"Find the fixed build number and vendor advisory for Don't Starve Together after 747465 at the NVD entry or Klei/Steam patch notes.","how_to_check":"- Check the installed Don't Starve Together build number in the Steam client or game files; unknown if the sources give a fixed build\n- Confirm whether the game is installed on the machine (Steam AppID 322330)","needs_analyst":true,"not_affected_if":["private-games-only","no-public-server-browsing"],"who_is_affected":"Players running Don't Starve Together builds through 747465 who browse or join public dedicated servers are exposed, since the crash is triggered by the malicious server listing's data when viewed or selected. Players who only play private or local games with trusted hosts are unlikely to encounter it. The sources do not describe any server-side exposure for hosts.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":3398,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-58458':14A,17A '322330':80C '747465':33B,83C 'allow':98C 'appid':79C 'attack':101C,128C,153C 'attacker-control':152C 'blob':125C 'bug':39B 'build':31B,82C 'caus':161C 'client':10A,24B,59B,113C,147C 'client-sid':146C 'contain':84C 'control':154C 'corrupt':38B,58B,88C,157C 'craft':53B,116C,130C 'crash':8A,62B,108C 'cve':12A,15A 'data':7A,56B,119C,155C 'decod':46B,96C,149C 'dedic':105C 'denial':164C 'dont':19B 'dont-starve-togeth':18B 'game':9A,23B,66B,112C 'game-cli':22B 'gen':55B,118C 'header':126C 'invalid':122C 'klei':123C 'length':127C 'list':136C 'lobbi':134C 'malform':5A 'malici':48B,132C 'memori':37B,60B,87C,159C 'memory-corrupt':36B,86C 'nativ':42B,92C,158C 'oper':102C 'persist':44B,94C,124C 'persistent-str':43B,93C 'player':64B 'public':49B,104C,133C 'publish':52B,115C 'remot':11A,100C,163C 'select':71B,141C 'server':6A,50B,73B,106C,135C 'servic':166C 'side':148C 'starv':3A,20B,29B,76C 'steam':26B,78C 'string':45B,95C 'togeth':4A,21B,30B,77C 'trigger':145C 'victim':110C,144C 'view':69B,139C 'vulner':89C 'world':54B,117C","nicknames":[],"mitigations":[],"who_affected":"Players running Don't Starve Together builds through 747465 who browse or join public dedicated servers are exposed, since the crash is triggered by the malicious server listing's data when viewed or selected. Players who only play private or local games with trusted hosts are unlikely to encounter it. The sources do not describe any server-side exposure for hosts.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58458","severity":null,"published_at":"2026-10-28T18:17:20+00:00","modified_at":"2026-10-28T18:17:20+00:00","first_seen_at":"2026-10-28T18:34:34+00:00","fetched_at":"2026-10-28T18:34:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}