When a DCC file transfer is resumed (option xfer.file.auto_resume, enabled by default), WeeChat sends a DCC RESUME message with the size of the partial file already received, and the remote peer replies with a DCC ACCEPT message containing the position to resume from.
The position received in DCC ACCEPT is not checked against the position sent by WeeChat, and it replaces it:
With a position equal to the file size, the transfer is immediately marked as successfully completed: the truncated partial file is kept as if it was complete, and its temporary suffix (option xfer.file.download_temporary_suffix) is removed.
With any other position, the data received is appended to the partial file at the wrong offset, so the file received is corrupted.
The transfer is identified only by its port, so a DCC ACCEPT message sent by another IRC user knowing the port can have the same effect.
In addition, the position received in DCC RESUME and DCC ACCEPT is not parsed strictly: an invalid value is not rejected, and when sending a file, a position greater than or equal to the file size is accepted.
Mitigation
There are multiple ways to mitigate this issue:
Disable the automatic resume of file transfers: /set xfer.file.auto_resume off
Keep the automatic accept of incoming files disabled (default) and accept files only from trusted users, see: /help xfer.file.auto_accept_files
Check the size or the checksum of files received after a resumed transfer