Don't Starve Together EUVD-2026-112278

Exploitation requires the attacker to operate a public dedicated server and publish a malicious public lobby server listing whose world_gen_data contains an invalid Klei persistent blob header length that drives the native persistent-string decoder to corrupt memory. The decisive limiting factor is user interaction (UI:A): the victim must actively view or select the attacker's lobby from the public server browser for the client-side decode to fire - it is not triggered by merely running the game. No authentication is required (PR:N), and the affected target is DST clients up to build 747465; impact is limited to crashing the victim's client (availability only), with no confidentiality or integrity effect and no code execution established in the available data.

This is a medium-severity, availability-only issue whose signals point to routine rather than emergency handling. The CVSS 4.0 vector (6.9) shows a network vector (AV:N) with low complexity (AC:N) and no privileges (PR:N), which looks alarming in isolation, but it is gated by required user interaction (UI:A) and the impact is scoped entirely to availability of the vulnerable system (VA:H; VC:N/VI:N, SC/SI/SA:N) - i.e. a client crash, not data theft or code execution. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a client-side denial of service that needs the victim to engage with an attacker-controlled lobby. No EPSS score is present in the provided data, so statistical exploitation probability cannot be weighed. There is no CISA KEV listing (status: not exploited per available data) and no confirmed public exploit, so this is not confirmed as actively exploited. One tension to flag: the CWE is CWE-787 (out-of-bounds write) and the description says native memory is corrupted, a bug class that can sometimes be escalated to code execution - yet both the assigned CVSS and the vendor framing scope impact to remote DoS only (VI:N/VC:N). Whether this out-of-bounds write could be driven beyond a crash is not established in the available sources and should be verified with VulnCheck/Klei rather than assumed. Net: a real but moderate client-side risk, best addressed by applying the available vendor update in a normal patch cycle.

An attacker stands up a public Don't Starve Together dedicated server and publishes a crafted public lobby listing whose world_gen_data carries an invalid Klei persistent blob header length. When a victim browsing the public server list views or selects that lobby, their game client decodes the attacker-controlled data, corrupts native memory, and crashes (remote denial of service). No public exploit is identified at time of analysis, and exploitation requires the victim to interact with the malicious listing (UI:A).