The vulnerability centers on unsafe deserialization allowing class file embedding. Key functions would be in the marshalling layer where serialized data is processed. While exact patch details are unavailable, historical patterns show that:

1. Marshaller.readObject() is the primary deserialization entry point
2. readResolve() methods control object replacement during deserialization
3. The vulnerability description explicitly mentions class file embedding and static initializers, which would be triggered during class loading in these methods
4. The fix in Drools 4.0.7 likely added allow-list validation in these critical deserialization paths to prevent arbitrary class loading