Digital Trends describes the Stagefright Vulnerability thus:


  The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming about it is that the victim doesn’t even have to open the message or watch the video in order to activate it. The built-in Hangouts app automatically processes videos and pictures from MMS messages in order to have them ready in the phone’s Gallery app.


How is it that a video file that hasn't been 'played' yet can be used to execute malicious code? Would anyone be able to give a more low-level explanation of how this is possible?

P.S.: To protect yourself just make sure to disable all the 'Auto-Download' features for MMS in your messaging apps (Hangout, Messaging, etc.).

The details will be released on the 5th of august. However, on the Cyanogenmod github repository there are several interesting details that appear to be related: it appears that certain fields in 3GPP video metadata are vulnerable to buffer overflow attacks. In short, a 3GPP video can be given a string of metadata that, at first, exceeds a certain length, and in the end includes machine code that lands in memory that is off-limits to the application.

Update: Cyanogenmod has released a patch for this vulnerability. 
