Don T Starve Together
Monthly
Remote client crash in Don't Starve Together (Steam AppID 322330) up to build 747465: a malicious public dedicated-server operator can publish a lobby whose world_gen_data carries an invalid Klei persistent blob header length, and when a victim views or selects that listing the client decodes the attacker-controlled data and corrupts native memory, terminating the game. No authentication is required, but the attack is gated by user interaction - the victim must actively browse and choose the crafted lobby, so merely running the game is not enough. Impact is availability only (client crash) with no confidentiality, integrity, or code-execution impact established; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor fix is available.
Remote client crash in Don't Starve Together (Steam AppID 322330) up to build 747465: a malicious public dedicated-server operator can publish a lobby whose world_gen_data carries an invalid Klei persistent blob header length, and when a victim views or selects that listing the client decodes the attacker-controlled data and corrupts native memory, terminating the game. No authentication is required, but the attack is gated by user interaction - the victim must actively browse and choose the crafted lobby, so merely running the game is not enough. Impact is availability only (client crash) with no confidentiality, integrity, or code-execution impact established; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor fix is available.