A vulnerability in caption files has been patched in some media players, but it's not clear how widespread the flaw still is