The vulnerability stems from executing containerizer/executor binaries from writable filesystem paths. The patches introduce memfd cloning to prevent binary replacement. Key vulnerable functions are those that: 1. Constructed command paths using path::join() with launcher_dir 2. Executed binaries via subprocess()/fork() with filesystem paths 3. Initialized container components without memory sealing. The CommandExecutor::launch and MesosContainerizerProcess::_launch functions directly handled binary execution paths prior to memfd protection, making them primary exploitation points.