Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for example Adobe Reader) is vulnerable to a buffer overflow. But is it possible to 'backdoor' a file without some special exploit, or are non-PE files safe?
There was an actual exploit that did this.
The problem isn't the image. It's the implementation of the application that reads the image data.
https://imagetragick.com/ - this is a great example of an application that read an image format, and executed code in that image.
But in general, no. Embedding shell code into an image should never allow execution of the shell code.