> PDFs are executables, that's why it's hard.
That isn’t really true, it’s not hard for PDF viewers to block by default (or just not implement) the problematic features, which also aren’t critical for the vast majority of PDF files.
The exploitable bugs are typically the usual, some buffer overflow in an underlying image or font library or similar, but unrelated to PDFs being “executable”.
What a sleight of hand. PDF's are obviously not executable, any more than text files are. Decoders are executable and they can choose to unsafely handle input. Even plain text editors can have exploits. It's no different than any piece of complex software.
The characterization of the PDF format specifically being “basically code” in any substantial manner is simply incorrect. The only PDF-specific features that reasonably meet that description is the PostScript support, which has fallen out of use decades ago and was completely removed in PDF 2.0, and the JavaScript support, which is optional, prohibited in PDF/A, and can easily be limited or omitted by a PDF viewer.
> the PostScript support
What do you mean by that?
Older PDFs support PostScript XObjects: literal embedded PostScript code. Not sure it counts tho, because IIRC it was never executed by PDF viewer itself. It was "gives this to printer when printing"
TIL! This is what PDF 1.7 spec says (§4.7.1):
> Beginning with PDF 1.1, a content stream can include PostScript language fragments. These fragments are used only when printing to a PostScript output device; they have no effect either when viewing the document on-screen or when printing it to a non-PostScript device. In addition, applications that understand PDF are unlikely to be able to interpret the PostScript fragments. Hence, this capability should be used with extreme caution and only if there is no other way to achieve the same result. Inappropriate use of PostScript XObjects can cause PDF files to print incorrectly.
> Note: Since PDF 1.4 encompasses all of the Adobe imaging model features of the PostScript language, there is no longer any reason to use PostScript XObjects. This feature is likely to be removed from PDF in a future version.