CVE-2026-58458 Don't Starve Together Memory Corruption via world_gen_data
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-58458?
CVE-2026-58458 is a medium-severity vulnerability in Klei Entertainment Don't Starve Together, published on 28 Oct 2026.
Official description
Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted world_gen_data with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.
Weakness: CWE-787
Which versions are affected by CVE-2026-58458?
How do I fix CVE-2026-58458?
No fix has been published for CVE-2026-58458 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-58458 being exploited?
There is no known exploitation of CVE-2026-58458 in the wild and no public exploit code.
Sources
Also known as GHSA-hxrq-hmg2-w94v.