Format string vulnerability in the URI handler in KVirc 3.4.0 when set as the default application for processing IRC URIs allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in the irc:// URI.