EPIC IRC Client (EPIC4) pre2.002 pre2.003 and possibly later versions allows remote malicious IRC servers to cause a denial of service (crash) and possibly execute arbitrary code via a CTCP request from a large nickname which causes an incorrect length calculation.