The vulnerability stemmed from 32-bit integer overflows in buffer size calculations during CBC-HMAC operations. The commit 789a4c4 shows critical changes replacing int with uint64 in: 1) Seal's ciphertext allocation, 2) Open's output buffer sizing, 3) computeAuthTag()'s buffer construction, and 4) the resize helper. These functions directly handled length calculations using 32-bit integers that could wrap around, enabling attackers to craft ciphertexts that bypass authentication checks. The Go vulnerability report (GO-2020-0009) explicitly lists the cbcAEAD methods as affected symbols, and the patch's focus on uint64 conversions confirms these were the vulnerable points.