CVE-2024-25062: Use-After-Free in libxml2 XML Reader with DTD Validation and XInclude

A use-after-free vulnerability exists in libxml2 v2.11.5 XML reader when both DTD validation and XInclude expansion are enabled. During backtracking in the XML parsing state machine, nodes are freed and unlinked. However, the XInclude expansion check executes immediately after without verifying the reader's backtracking state, leading to access of freed memory when dereferencing freed node pointers.