The path of hdata returned to the client with the "weechat" protocol is built in a buffer allocated with twice the length of the path received, but a variable name can be replaced by a hdata name more than twice longer (for example "next_nick" replaced by "irc_channel_speaking"), so that an authenticated client can write out of bounds with a path containing many such variables.
Mitigation
There are multiple ways to mitigate this issue:
Remove all relays with protocol "weechat", see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload