GStreamer 1.28.9 release addresses security vulnerabilities and playback stability

The GStreamer team has released version 1.28.9, a maintenance update for the stable 1.28 series of the widely used multimedia framework. This release focuses on resolving security vulnerabilities, improving playback stability for music and video players, and refining hardware acceleration support.

Key improvements target various subsystems, including fixes for out-of-bounds reads in MPEG-4 parsers and race conditions in RTP session protection. The update also enhances desktop integration by addressing Wayland hotplugging and preventing GTK4 from interfering with externally managed EGL displays.

Technical improvements in GStreamer 1.28.9

• Security Fixes: Resolves an incomplete fix for an out-of-bounds read in the MPEG-4 video parser (GST-SA-2026-0049) and a use-after-free/race condition in the RTP session denial-of-service protection (GST-SA-2026-0074).
• Multimedia Playback: Fixes assertion errors in decodebin3 and playbin3 to prevent application crashes, and corrects MP4 demuxer behavior when seeking beyond file boundaries in push mode.
• Hardware Acceleration: Improves VA-API encoder accuracy by removing unsupported format advertisements and fixes V4L2 video decoder format negotiation delays for H.264 and H.265.
• Desktop & Display: Enhances Wayland support through improved output hotplug handling and updates the GTK4 paintable sink to correctly mark EGL displays as foreign.
• Streaming & Protocols: Corrects HLS timestamp progression in awss3hlssink and resolves stream-writing regressions in hlssink3 affecting CMAF and WebVTT output.

Why it matters

As a foundational multimedia framework, this update is critical for Linux desktop environments, media players, and streaming applications to ensure security and stability. The fixes for Wayland and hardware acceleration (VA-API/V4L2) directly benefit the reliability of video playback on modern Linux distributions and embedded systems.