Code analysis revealed multiple potential NULL derefence conditions (currently unconfirmed)

src/xercesc/util/MsgLoaders/InMemory/InMemMsgLoader.cpp

If fMsgDomain doesn't match one of the 4 else clauses, it could dereference null at line 106

src/xercesc/internal/IGXMLScanner.cpp

The !elemDecl check on line 2383 appears to be missing a final else clause to catch unknown grammar types.

src/xercesc/internal/XSObjectFactory.cpp

If the xsMultiFacetList is not allocated at line 840, there are no obvious checks later in the function to ensure it is not dereferenced

src/xercesc/validators/DTD/DTDScanner.cpp

If the first branch followed is "else if (fReaderMgr->skippedChar(chCloseParen))" at line 1210, lastNode can potentially dereference a NULL at line 1225