CVE-2016-8736: Apache OpenMeetings RCE

The vulnerability (CVE-2016-8736) is explicitly an RMI deserialization attack. Java RMI uses serialization/deserialization for remote object communication. If the RMI registry is initialized without proper security controls (e.g., a validating ObjectInputFilter or security manager), attackers can send malicious serialized objects to execute arbitrary code. The patched version (3.1.2) likely added validation to the RMI registry setup. The function responsible for binding RMI services (e.g., RMIServiceImpl.bindToRegistry) would be the logical point of vulnerability, as it handles RMI endpoint exposure and deserialization logic.