It might be a bit too specific, but the PDF.js arbitrary javascript execution (CVE-2024-4367) is quite a powerful vector for PDF files. Might be worth implementing.