I wonder if it is secure to open PDF and other document files with embedded/linked fonts and images (the most of PDF files have them embedded, the most of webpages have images and very large share of them use site-provided fonts). I mean if modern viewers pass this kind of stuff to the OS and kernel, or do they deal with the formats purely in userland in their own processes using some libraries and which one does what?
Opening a document is only secure if all the components used to edit/display it contains no security flaws.
If a security flaw exists in the software used to display/edit the document or in any component (library or service) that it uses to process some elements like images or fonts, a specially crafted document can exploit the security flaw.
What it actually attacked here is not the document itself but one specific program or library that is used to process it. Said differently a rogue document could exploit the security flaw when edited with software A but not with software B.