"The vulnerability is triggered by freeing a TextLine object within the valueOf function of a custom class when setting the TextLine's opaqueBackground,"

"Exploitation continues by finding the corrupted Vector object by its length, which will be greater than 100. This enables the object to change an adjacent Vector object's length to 0x40000000."