pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open as used in Inside Secure TLS Toolkit has a stack-based buffer overflow during X.509 certificate verification because of missing validation in psRsaDecryptPubExt in crypto/pubkey/rsa_pub.c.