The disabling instructions I've encountered include:
1. In messaging apps, disable automatic downloading of mms messages (like what Jibz said)
2. In APN settings, disable some appropriate mms-related settings (didn't manage to become clear enough on exactly what though)
3. For rooted phones, put media.stagefright.enable-player=false in /system/build.prop (likely have to do something like: 'mount -o remount,rw /system' as root first)
The first two suggestions might help to mitigate the issue, but there may be other ways for the code in question in stagefright to get executed, IIUC.
My current understanding is that on some phones the code in question can get executed with system level privileges (e.g. Galaxy S4), but not necessarily on all phones. So I guess depending on one's phone, how nasty this is may be quite different.
Regarding updates, IIUC, the Cyanogemod 12.x (nightly) series has been patched: https://plus.google....od/posts/7iuX21Tz7n8
Personally I'm waiting for:
CM11 will see these updates hit as part of out of band fixes this weekend (these releases occur weekly).