Klei Entertainment Don't Starve Together up to 747465 Persistent-String Decoder buffer overflow

Summaryinfo

A vulnerability classified as problematic was found in Klei Entertainment Don't Starve Together up to 747465. Affected by this vulnerability is an unknown functionality of the component Persistent-String Decoder. Such manipulation leads to buffer overflow. This vulnerability is referenced as CVE-2026-58458. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Klei Entertainment Don't Starve Together up to 747465. It has been rated as problematic. Affected by this issue is an unknown function of the component Persistent-String Decoder. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is availability. CVE summarizes:

Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.

The advisory is shared for download at kleiforums.com. This vulnerability is handled as CVE-2026-58458 since 06/30/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/28/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Klei Entertainment

Name

• Don't Starve Together

Version

• 747465

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion