The vulnerability stems from missing message size validation in the messaging subsystem. The core messaging function message_send() in message/lib.php is directly responsible for processing and delivering messages. In vulnerable versions, this function lacked input size checks, enabling transmission of unbounded message payloads. The CWE-400/770 mapping confirms this is a resource consumption issue, and the Moodle security advisory (MDL-67782) specifically references messaging component changes. While exact commit details are unavailable, message_send() is the logical entry point where size validation would be implemented, making it the most likely vulnerable function.