The output buffer used for charset conversion was allocated with 4 bytes per input byte, but some charsets like TSCII produce more (up to 12 bytes), and the replacement char "?" for invalid chars was written without checking the remaining size, so the output buffer could overflow.
For example a malicious IRC server, or any user sending a message on a channel, could trigger the overflow when the decode charset is set to TSCII.
Note: the default decode charset iso-8859-1 is not affected.
Mitigation
Do not use charset TSCII for decoding: check option charset.default.decode and the options in section "decode" of charset plugin, see: /help charset.