Firmware release notes 4.9.5

Release 4.9.5

Release name: "Castor" 4.9.5. Release date: February 3^rd, 2026.

Applies to HMP400/W, iBX410/W, iBX440, HMP350, HMP300, DiVA, and third-party DSOS players.
Firmware version number: 4.9.5-1.0.0-ef0741b0

Improvements

• Added WUXGA 16:10 (1920x1200) to the list of available display resolutions in Control Center, under the "simple" configuration type, for all DSOS players, except for HMP350, HMP300, and DiVA.

Fixes

• The MQTT daemon could become stuck in case of broker failures on the cloud; the daemon now implements an acknowledge timeout and recovery mechanism for such cases.
• The timestamp in the Pull Mode's optional publish action feedback report was always 0 (unix epoch time); it now reflects the correct time.

 

Applies to all DSOS players, except for HMP350, HMP300, and DiVA.

• The player could crash if a display was reported as connected by the graphics driver but no EDID was available.

Security

Updated base libraries and components; the main changes are as follows:

 

Applies to all DSOS players.

• openssh: fix CVE-2025-61984 and CVE-2025-61985, which affected DSOS.
• libpng: fix CVE-2025-66293, CVE-2025-65018, CVE-2025-64720, CVE-2025-64506 and CVE-2025-64505, all of which affected DSOS.
• gnutls: fixed CVE-2025-9820, which did not affect DSOS.
• libxml2: fixed CVE-2025-7425, which did not affect DSOS.
• elfutils: fixed CVE-2025-1377 and CVE-2025-1376, which did not affect DSOS.
• binutils: fixed CVE-2025-11413 and CVE-2025-11412, which did not affect DSOS.

 

Applies to HMP400W, iBX410W, and third-party DSOS players with Wi-Fi support.

• wpa-supplicant: fixed CVE-2025-24912, which did not affect DSOS.

 

Applies to DIVA, HMP300, HMP350.

• u-boot: fixed CVE-2024-42040, which did not affect DSOS.