While the OEMs are busy rolling out updates to fix Stagefright vulnerability, the custom ROMs remained affected at large. The chief of which is CyanogenMod custom ROM, which is also used as base for many, many other AOSP custom ROMs.

Thankfully, the team has acted swiftly, and have made it official that there source code has been updated to include the fix for Stagefright, and that next builds of the ROM will include it.

Further, the stable version of CM11 and CM12 will gets newer stable version with the fix. Ditto for CM12.1, the latest version of the CyanogenMod ROM.

There will be some problem with devices that are neither supported by the Cyanogen team, not have active developers working anymore. But all in all, if you are downloading the ROM from official page here, then your ROM should have the fix already pretty soon. Or, if the build is new after the source code was updated with the fix, then too you are covered — request the CM maintainer for your device to update the ROM for this.

Via CM