In principle, any piece of software can have zero-days in it. PDF readers included. Scripting languages can help with certain exploits, but arent vulnerabiliti

In principle, any piece of software can have zero-days in it. PDF readers included. Scripting languages can help with certain exploits, but arent vulnerabilities in and of themselves. Anyhow, theoretically possible but also kind of unlikely. Such attacks usually have a shortish shelf life so are used in more targeted fashion to prolong the exploits life and get the most value from it.