The GStreamer team has announced GStreamer 1.28.9, the latest maintenance update in the stable 1.28 series, which includes follow-up fixes for two previously addressed vulnerabilities.
The first concerns an incomplete fix for an out-of-bounds read in the MPEG-4 video parser, tracked as GST-SA-2026-0049. The second addresses a use-after-free issue and race condition in the RTP session’s denial-of-service protection mechanism, tracked as GST-SA-2026-0074.
On the playback side, GStreamer 1.28.9 fixes an assertion in decodebin3 and playbin3 that could cause music players to crash when processing certain files and sources. The MP4 demuxer also receives a correction for seeking beyond the end of a file in push mode.
Streaming improvements include a fix for RTSP sources that reuse a fallback URL when dealing with non-compliant servers across multiple tracks. The H.264 and H.265 RTP depayloaders also receive corrections to their header extension tracking.
For HTTP Live Streaming, the update fixes incorrect EXT-X-PROGRAM-DATE-TIME progression in awss3hlssink, where timestamps could advance at twice the intended rate. Hlssink3 also resolves a stream-writing regression affecting CMAF and WebVTT output.
Hardware acceleration also receives several corrections. The VA-API encoder no longer advertises unsupported formats. V4L2 video decoders gain fixes involving delayed format negotiation for H.264 and H.265, improving compatibility with decodebin2.
For Linux desktop users, the release fixes Wayland output hotplug handling. The GTK4 paintable sink also now marks EGL displays as foreign, preventing it from terminating displays managed by other components.
Other changes include support for 24-bit audio levels in the level element, a fix for crashes when stopping ASIO elements, and a correction for NTP timestamp rollover beyond 2036 in the ISOBMFF implementation.
Finally, GStreamer 1.28.9 includes build fixes for Intel Quick Sync Video and Direct3D components in recent MSYS2 environments. Rust plugins now support cross-compilation with a sysroot through Meson, and the Cerbero build system receives updated CA certificates, pip updates, and fixes for rolling-release distribution versions.
For more information, see the release notes.
