The vulnerability description explicitly identifies the ng-srcset directive's value splitting regex as the root cause. While exact implementation details aren't provided in available sources, AngularJS architecture dictates that srcset handling would be implemented in directive processing code. The confidence is high because:

1. The advisory specifically calls out ng-srcset as the vulnerable directive
2. ReDoS vulnerabilities in this context typically stem from the regex used for attribute parsing
3. AngularJS 1.x's EOL status matches the affected versions
4. Multiple independent sources (NVD, Snyk, GHSA) confirm the attack vector involves ng-srcset processing