Hacked in Translation – From Subtitles to Complete Takeover (blog.checkpoint.com)

More info, since the article is light on actual information on the vulnerability: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8314 (points to https://github.com/xbmc/xbmc/pull/12024/commits/35cfe35608b1...)