---
id: "CVE-2026-58458"
kind: "vulnerability"
aliases: ["CVE-2026-58458"]
title: "Don't Starve Together: malformed server data crashes game client remotely"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["dont-starve-together", "game-clients", "other", "steam"]
not_affected_if: ["no-public-server-browsing", "private-games-only"]
published_at: "2026-10-28T18:17:20+00:00"
first_seen_at: "2026-10-28T18:34:34+00:00"
updated_at: "2026-10-28T18:34:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58458", "first_seen_at": "2026-10-28T18:34:34+00:00"}]
---

# Don't Starve Together: malformed server data crashes game client remotely

Don't Starve Together builds through 747465 have a memory-corruption bug in the native persistent-string decoder. A malicious public server can publish crafted world_gen_data that corrupts client memory and crashes a player's game when they view or select the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Don't Starve Together build number in the Steam client or game files; unknown if the sources give a fixed build
- Confirm whether the game is installed on the machine (Steam AppID 322330)

## Fix

- Update Don't Starve Together through Steam to a build newer than 747465; the exact fixed build is unknown from the sources
- Avoid joining or browsing untrusted public servers until updated

## Timeline

- 2026-10-28T18:34:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-58458

## From the sources

Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_