Exploits for media format handling code often just use memory safety bugs to get code execution. It can and does happen with simpler formsts too, eg image and video formats.

Adobe acrobat is infamous for being infested with vulnerabilities.

(But yes, PDFs support scripting)