The vulnerability stemmed from how GetExecUser in libcontainer/user/user.go processed user specifications. The pre-patch implementation attempted to match user arguments against both usernames and stringified UIDs, allowing numeric usernames to be interpreted as UID values. The GitHub patch shows this function was modified to: 1) pre-convert user arguments to numeric IDs, 2) eliminate username comparisons for numeric inputs, and 3) strictly treat numeric arguments as UIDs. The CVE description and commit message explicitly reference this function's flawed logic as the vulnerability source.