The vulnerability stems from line 98 in array_queue.rs where pop_back uses raw length-based indexing instead of the crate's index() method that handles circular buffer wrapping. Multiple advisories and the PoC demonstrate this leads to accessing invalid memory locations after elements are removed from both ends, creating use-after-free conditions. The unpatched versions' lack of proper index calculation confirms this as the root cause.