Arbitrary files can be embedded inside a PDF (by design), such as malicious code files. Many PDF readers have security issues allowing for PDFs to automatically allow for code execution of those embedded files, or prompt the user for a click to execute the files.

Just search for something like “executable code inside PDF” and browse through the many results of examples, issues, and tutorials to see.