The issue is related to an integer overflow in the `xml utf8 decode` function, which can be exploited by remote attackers using a crafted string with overlong UTF-8 encoding. This allows attackers to bypass protection mechanisms against cross-site scripting (XSS) and SQL injection.