Issues

• Heap OOB write in workaroundSpecConstant via unchecked SPIR-V wordCount (.filamat)

  google/filament#10525 · Filter by author ph4nt0mbyt3 opened on Oct 2, 2026

• Heap buffer overflow via integer overflow in BasisU transcoder total_blocks (KTX2)

  google/filament#10523 · Filter by author ph4nt0mbyt3 opened on Oct 2, 2026

• Heap out-of-bounds read/write in SurfaceOrientation via unvalidated triangle indices (NDEBUG-only, reachable from untrusted glTF) — unpatched 90+ days after GHSA-x24w-mhq6-m5vf

  google/filament#10521 · Filter by author prasanna8585 opened on Oct 2, 2026

• gltfio: heap OOB write in AssetLoaderExtended via slotIndices sizing mismatch

  google/filament#10500 · Filter by author ph4nt0mbyt3 opened on Sep 30, 2026
  1

• Integer overflow in gltfio DracoCache.cpp and AssetLoader.cpp leads to heap buffer overflow

  google/filament#10495 · Filter by author ph4nt0mbyt3 opened on Sep 29, 2026

• Swapchain resize doesn't work in Wayland

  google/filament#10449 · Filter by author AlexRamallo opened on Sep 19, 2026
  

• MeshAssimp: glTF texture URI is joined without a containment check, allowing path traversal outside the model directory

  google/filament#10431 · Filter by author YashvantHange opened on Sep 16, 2026
  

• gltfio: Animator never clamps morph-weight counts to the 256-target limit — spec-conforming GLB with >256 morph targets and a weights channel aborts in setMorphWeights

  google/filament#10409 · Filter by author alencheung opened on Sep 11, 2026
  

• [Metal] Descriptor set layout bindings out-of-bounds access and unsorted bindings invariant violation

  google/filament#10406 · Filter by author poweifeng opened on Sep 10, 2026
  

• Add support for multiple Dear ImGui viewports to filagui

  google/filament#10393 · Filter by author Jmangles opened on Sep 8, 2026

• Implement the missing async functions of WebGPUDriver

  internalwebgpu
  google/filament#10374 · Filter by author yrcloud opened on Sep 1, 2026
  2

  

• setImage - No value passed for parameter

  google/filament#10362 · Filter by author sylalex opened on Aug 30, 2026

• tvOS support (appletvos + appletvsimulator)

  google/filament#10339 · Filter by author tim4724 opened on Aug 20, 2026

• Wrong UVs for Quad.

  google/filament#10321 · Filter by author RoastedKaju opened on Aug 17, 2026
  2

• lit shading model produces black faces on Metal (NaN propagation from half-precision NoV)

  google/filament#10280 · Filter by author mjsikorsky opened on Aug 9, 2026
  3

  

• get-commit-msg: head_commit.author.name/email are interpolated into the run: block while the sibling commit message is env-guarded

  google/filament#10279 · Filter by author bilguunbicktivism opened on Aug 8, 2026
  1

• beamsplitter deletes hand-written declarations that AGENTS.md tells agents to regenerate

  google/filament#10271 · Filter by author karpovantonme opened on Aug 6, 2026

• android: expose RenderableManager.PrimitiveType value

  google/filament#10263 · Filter by author eqgis opened on Aug 4, 2026
  3

• gltfio: UvMap out-of-bounds access in constrainMaterial and processShaderString via unclamped glTF texCoord index

  gltfsecurity
  google/filament#10202 · Filter by author destro4evr-rgb opened on Jul 13, 2026
  1

• gltfio: heap OOB write in cgltf_accessor_unpack_floats via meshopt-bypassed sparse accessor index

  gltfsecurity
  google/filament#10201 · Filter by author destro4evr-rgb opened on Jul 12, 2026
  1

• filameshio: heap OOB write in MeshReader compressed vertex path when UV1 absent but sizes.uv1 non-zero

  gltfsecurity
  google/filament#10200 · Filter by author destro4evr-rgb opened on Jul 12, 2026
  1

• gltfio: heap OOB read in updateBoneMatrices() - asset->mSkins desync when createSkins() skips validation failures

  gltfsecurity
  google/filament#10198 · Filter by author destro4evr-rgb opened on Jul 11, 2026
  1

• gltfio: heap OOB read in uploadBuffers() - accessor count vs morphTargetCount mismatch

  gltfsecurity
  google/filament#10197 · Filter by author destro4evr-rgb opened on Jul 11, 2026
  3

• gltfio: heap out-of-bounds write in TangentsJob via unvalidated MAT4-typed morph normal/tangent accessor (type confusion)

  gltfsecurity
  google/filament#10194 · Filter by author ataberk-xyz opened on Jul 10, 2026
  1

• gltfio: EXT_meshopt_compression indices bypass cgltf validation → OOB index read

  gltfsecurity
  google/filament#10193 · Filter by author adilburaksen opened on Jul 10, 2026