The vulnerability description explicitly identifies remove() as the source of double-free issues. The GitHub issue demonstrates that passing an invalid index to remove() triggers a panic after temporary vector allocation, leading to double-free during unwinding. The RustSec advisory specifically calls out remove()'s lack of panic safety. The code references in the issue (lines 139-152 of compact.rs) show unsafe temporary vector handling without proper guard conditions to prevent double-free scenarios.