diff -Nru libxmlb-0.3.6/debian/changelog libxmlb-0.3.6/debian/changelog
--- libxmlb-0.3.6/debian/changelog	2022-03-24 17:15:30.000000000 +0100
+++ libxmlb-0.3.6/debian/changelog	2022-09-06 18:47:07.000000000 +0200
@@ -1,3 +1,9 @@
+libxmlb (0.3.6-3) jammy; urgency=high
+
+  * Fix double-free bug.
+
+ -- Sergio Costas Rodriguez <sergio.costas@canonical.com>  Tue, 06 Sep 2022 18:47:07 +0200
+
 libxmlb (0.3.6-2build1) jammy; urgency=high
 
   * No change rebuild for ppc64el baseline bump.
diff -Nru libxmlb-0.3.6/debian/patches/Fix-double-free-bug libxmlb-0.3.6/debian/patches/Fix-double-free-bug
--- libxmlb-0.3.6/debian/patches/Fix-double-free-bug	1970-01-01 01:00:00.000000000 +0100
+++ libxmlb-0.3.6/debian/patches/Fix-double-free-bug	2022-09-06 18:47:07.000000000 +0200
@@ -0,0 +1,45 @@
+Description: Fix double-free bug
+ Under some circumstances, depending on the specific data feeded to
+ libxmlb, a memory block can be freed twice during the final tree
+ prune, when the nodes with less priority are removed.
+ .
+ libxmlb (0.3.6-3) jammy; urgency=high
+ .
+   * Fix double-free bug.
+
+Author: Sergio Costas Rodriguez <sergio.costas@canonical.com>
+Applied-Upstream: https://github.com/hughsie/libxmlb/pull/127
+Bug-Ubuntu: https://bugs.launchpad.net/snap-store-desktop/+bug/1988440
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: https://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: 2022-09-06
+
+--- libxmlb-0.3.6.orig/src/xb-builder.c
++++ libxmlb-0.3.6/src/xb-builder.c
+@@ -438,7 +438,7 @@ xb_builder_xml_lang_prio_cb (XbBuilderNo
+ 	for (guint i = 0; i < nodes->len; i++) {
+ 		XbBuilderNode *bn2 = g_ptr_array_index (nodes, i);
+ 		if (xb_builder_node_get_priority (bn2) < prio_best)
+-			g_ptr_array_add (nodes_to_destroy, bn2);
++			g_ptr_array_add (nodes_to_destroy, g_object_ref(bn2));
+ 
+ 		/* never visit this node again */
+ 		xb_builder_node_set_priority (bn2, -2);
+@@ -751,7 +751,7 @@ xb_builder_compile (XbBuilder *self, XbB
+ 	XbBuilderNodetabHelper nodetab_helper = {
+ 		.buf = NULL,
+ 	};
+-	g_autoptr(GPtrArray) nodes_to_destroy = g_ptr_array_new ();
++	g_autoptr(GPtrArray) nodes_to_destroy = g_ptr_array_new_with_free_func ((GDestroyNotify) g_object_unref);
+ 	g_autoptr(GTimer) timer = xb_silo_start_profile (priv->silo);
+ 	g_autoptr(XbBuilderCompileHelper) helper = NULL;
+ 
diff -Nru libxmlb-0.3.6/debian/patches/series libxmlb-0.3.6/debian/patches/series
--- libxmlb-0.3.6/debian/patches/series	1970-01-01 01:00:00.000000000 +0100
+++ libxmlb-0.3.6/debian/patches/series	2022-09-06 18:47:07.000000000 +0200
@@ -0,0 +1 @@
+Fix-double-free-bug