Digital Trends describes the Stagefright Vulnerability thus:
The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming about it is that the victim doesn’t even have to open the message or watch the video in order to activate it. The built-in Hangouts app automatically processes videos and pictures from MMS messages in order to have them ready in the phone’s Gallery app.
How is it that a video file that hasn't been 'played' yet can be used to execute malicious code? Would anyone be able to give a more low-level explanation of how this is possible?
P.S.: To protect yourself just make sure to disable all the 'Auto-Download' features for MMS in your messaging apps (Hangout, Messaging, etc.).