The vulnerability stems from unsafe YAML deserialization in Apache Heron's simulator component. While explicit patch details are unavailable, the CVE description explicitly identifies missing YAML parser security configurations as the root cause. In Java/YAML vulnerabilities, the critical functions are typically:

1. The YAML loading/parsing entry point (loadFromString)
2. The parser initialization method (createYaml)

These would appear in runtime profiles during exploitation as they directly handle untrusted data deserialization. The high confidence for loadFromString aligns with standard YAML attack patterns, while createYaml receives medium confidence as the configuration point that should enforce SafeConstructor usage.