Use-After-Free (UAF) vulnerability in the namespace handling logic of libxml2, occurring in the xmlSetTreeDoc() function. The flaw arises when XML nodes with namespaces are moved between documents using xmlAddChild() or xmlReplaceNode(). The internal function xmlNodeSetDoc() updates the node’s document pointer but fails to update its ns (namespace) reference, which still points to memory from the original document. Once the source document is freed, any subsequent operation accessing the namespace (e.g., serialization via xmlDocDumpMemory()) leads to a UAF and potential crash. The issue can be triggered by crafted XML documents processed by applications using libxml2, and may result in a denial of service.