Release notes for version 18.05, 2018-04-30 include:

> CVE-2018-10115 - Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

Excellent article from the bug discoverer here: https://landave.io/2018/05/7-zip-from-uninitialized-memory-t...

Some good discussion in the linked HN discussion from a couple of days ago.