Basically there's a bunch of different vulnerabilities in various chipsets and operating systems that can, in some cases, allow remote code execution.

The most common fault seems to allow a remote attacker to pretend to be an internet connection for a bluetooth enabled device and perform man in the middle attacks.

Wait for your OS vendor to push out updates and make sure websites you visit are using HTTPS.