On Tuesday, security research firm Checkpoint announced that its team had discovered a new vulnerability in numerous media players that allows a hacker to take full control of any device when a malicious subtitle file is used. The firm estimates 200 million people are potentially at risk. To be clear, if you're using a media player to watch a legitimate copy of a film that already has subtitles, you're probably just fine. But if for any reason you visited one of the numerous websites that allow you to download subtitles for movies in various languages, you could be at risk. People download these files for many reasons, not just for the purposes of piracy. There's a thriving community of people that translate film dialogue for the good of everyone but, unfortunately, there could be some bad actors out there.

Our research reveals a new possible attack vector, using a completely overlooked technique in which the cyberattack is delivered when movie subtitles are loaded by the user's media player. These subtitles repositories are, in practice, treated as a trusted source by the user or media player; our research also reveals that those repositories can be manipulated and be made to award the attacker's malicious subtitles a high score, which results in those specific subtitles being served to the user. This method requires little or no deliberate action on the part of the user, making it all the more dangerous.

Unlike traditional attack vectors, which security firms and users are widely aware of, movie subtitles are perceived as nothing more than benign text files.

Here are the media players that are affected and how to update them: PopcornTime, Kodi, VLC, Stremio.