CVE-2026-58458— Don't Starve Together Memory Corruption via world_gen_data

Quick assessment

Affected

Klei Entertainment Don't Starve Together

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

《饥荒：联机版》（Steam 应用 ID 322330）在构建版本 747465 及之前存在一个内存破坏漏洞，该漏洞位于原生持久化字符串解码器中。远程攻击者可通过运营公开专用服务器，发布包含无效 Klei 持久化数据块头部长度的恶意 world_gen_data，从而导致受害者的游戏客户端崩溃。攻击者可构造恶意的公开大厅服务器列表条目；一旦受害者查看或选择该条目，便会触发客户端对攻击者控制的数据进行解码，进而破坏原生内存并引发远程拒绝服务（DoS）。

CVSS 6.5 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Klei Entertainment	Don't Starve Together	`≤ 747465`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Don't Starve Together Memory Corruption via world_gen_data

Source: CVE Program / CVE List V5

Vulnerability Description

Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Klei Entertainment	Don't Starve Together	0 ~ 747465	-

II. Public POCs for CVE-2026-58458

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-58458

请登录查看更多情报信息。

Other References for CVE-2026-58458 (2)

https://kleiforums.com/game-updates/dst/ release-notes patch
https://www.vulncheck.com/advisories/don-t-starve-together-memory-corruption-via-world-gen-data third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-58458

IV. Related Vulnerabilities

Same weakness: CWE-787