A malicious (or compromised) relay remote can send a "buffer_closed" event with an array, causing a use-after-free (read and write) followed by a double free, in the relay plugin.
Note: if the remote is a trusted WeeChat, the problem does not happen, as WeeChat itself never sends an array in the "buffer_closed" event.
Mitigation
Always connect to a trusted WeeChat remote.
Credit
The issue was discovered by Mohammed Arib (arib06).