An XML reader enables DtdProcessing.Parse or assigns an XmlResolver, exposing the parser to XXE attacks.
Set DtdProcessing to Prohibit and XmlResolver to null when parsing untrusted XML.