libunrar.a in UnRAR prior to 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.
rarlab unrar