“Can’t media format X run arbitrary code” is almost never an issue with the format itself and virtually always a bug with a particular decoder/player.