The vulnerability stems directly from Server_debug's use of vsprintf with a fixed-size buffer. The GitHub issue explicitly shows the code pattern: vsprintf(buffer, format, args) where buffer is 256 bytes and format includes user-controlled filename input. This matches CWE-120's classic buffer overflow pattern. While Server_start_rec_internal passes the filename to Server_debug, the actual unsafe buffer operation occurs within Server_debug itself. The combination of external input control (filename), fixed buffer size, and unsafe vsprintf usage provides high confidence in this assessment.