The vulnerability resides in the native persistent-string decoder used by the game client. A malicious player can submit world_gen_data that contains a malformed persistent blob header length. When the victim client downloads and decodes this data during a lobby join, the decoder corrupts native memory, leading to an immediate crash of the game client. This results in a denial of service to the victim while the attacker remains undetected.

The affected product is Don\'t Starve Together by Klei Entertainment, specifically version build 747465. Only game clients that connect to public dedicated servers are vulnerable; the vulnerability is triggered by an attacker-controlled lobby listing.

The CVSS score of 6.9 places the vulnerability in the moderate range, indicating a non-zero risk of exploitation. The EPSS score is not available, so the probability of exploitation cannot be quantified from the public data. The vulnerability is not listed in CISA KEV, suggesting that it has not yet been widely exploited in the field. Attackers can exercise this vulnerability remotely by operating a public dedicated server and publishing a crafted world_gen_data entry, after which any player who views or selects the lobby will trigger the client-side crash.