The vulnerability stems from missing capacity checks in three key areas:

1. The From<InlineArray> implementation (CVE's primary focus) allows converting an InlineArray of any size to Chunk without validation.
2. The unit() constructor creates single-element chunks without verifying capacity constraints.
3. The pair() constructor creates two-element chunks without capacity checks. These are directly demonstrated in the test cases from GHSA-64gv-qg2v-vxv6 where U0 capacity chunks were overfilled. The RustSec advisory and CVE description explicitly call out these specific construction methods as vulnerable due to missing size validation (CWE-129).