I saw this question about reading a USB stick safely, and it made me wonder about SD and microSD cards. I've been told that SD/microSD cards are safer, and that I needn't worry as much about just plugging one in as I would a USB stick. Is this true? What sorts of vulnerabilities do SD/microSD cards have the USB sticks don't, and vice versa? Also, given a particular SD/microSD card, will formatting it make it safe to use again?
The core SD data protocol can only expose itself as a mass storage device, which prevents a lot of the fun badUSB style attacks. If your host supports SDIO, the attack surface grows massively.
The card also contains a full MCU, typically ARM/8051, which can (at minimum) lie to you about the contents of flash a la IRATEMONK. See https://www.bunniestudios.com/blog/?p=3554. Formatting the card is thus NOT sufficient to "clean" it. Given the price of SD cards, if you're at all concerned about its provenance it's better to just chuck it and buy a new one from a trusted source.
TL;DR probability of RCE is lower than with USB, but there are definitely still nasty things possible.
A typical SD card contains a filesystem with files on it. Your operating system has code to read the filesystem. If there are any bugs in that code, it may be possible for the SD card to run arbitrary things on your system when it is read. So just by inserting the SD card (or mounting a filesystem on it) your system could be compromised.
Here is an example with NTFS.
To protect against this, you can read the raw data on the SD card instead of mounting the filesystem. However, this makes it pretty hard to do anything useful with the data.