Yes, stamping out file format vulnerabilities is indeed a Sisyphean task

For example https://en.wikipedia.org/wiki/Melissa_(computer_virus)