When the IRC server sends an empty PREFIX in message 005 and the connection is lost before message 001, the nicks are kept with 1-byte prefixes while the default prefix chars ("@+") are restored on reconnection, so that the next prefix set on a nick (for example with message 353) is written out of bounds.
Note: a "normal" IRC server should not send an empty PREFIX in message 005, so the problem should be limited to malicious IRC servers.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.