Sure. Whether they’re effective and actually able to execute is another question.

A simple way might simply be to put an actual executable in the file instead, and when a user double clicks to open it it’ll run instead. Or there’s stuff to hide in metadata that could exploit particular players, or even some OS preview systems, and get execution that way.

But…..really pretty unlikely. Possible definitely, but you’d have to go through a lot of effort to get hit by something.

Hypothetically yes. But consider that much like a virus growing in a petri dish, it needs an appropriate environment. A mp4/mkv/whatever file sitting on your hard drive that you never access is not going to be problematic. Even when you do access it, it is probably is not going to do anything unless you also open it in the viewer that the malware author intended the payload for. There is no general purpose video decoding malware. They target the players.

There are a bunch of vulnerabilities for VLC for example. Some of them are based on modified .avi or .mkv files.

Note that those are all known and already patched but there are certainly some vulnerabilities out there that are unknown and/or unpatched. You're quite unlikely to get one of those though.

The biggest security issue probably is an unpatched system so don't forget to keep your software up to date.

for the most part, you're safe; because media files aren't executable (like exe, appimage, etc) including a virus in the file wouldn't do much. there could be a zero-day (e.g buffer overflow in the media file that exploits a flaw in the player/decoder, but that isn't anywhere near as common as including malware in executable files.

Yes.

Depends on the virus, but unlikely.

The thing about viruses is that it is an arms race. It's almost impossible to get a virus from playing media on your computer. Why? Well, let me explain in a 3 easy steps:

1. Viruses have specific goals. They want to spy on you, encrypt your files, use your computer on a botnet, access ads with your computer, etc. In order to do that, they must gain access within your system to do those things.

2. Since they need access, the easiest way to get access is just by simply asking you. Which is why executables (software and games) are the riskiest stuff to pirate. But it's possible to get viruses from other sources, they do that by exploring flaws in the software. For example, a while ago they managed to insert viruses through VLC media player subtitles.

3. However, simply exploiting a flaw isn't enough because flaws get fixed. Following the VLC Media player example, few days after the virus was distributed, VLC launched a new version that corrected the flaw, making the virus useless. Therefore, it's necessary that the virus either explores a 0-day (a flaw that hasn't been widely discovered - this kind of information is sold for a lot of money on the deep web and is usually used to hack governments and bit corporations) or targets people using old software on their machines.

In conclusion: you can catch Aids having sex with condoms, maybe it had a tear, maybe you had a small bleeding on your mouth, etc, but you aren't getting aids using condoms unless you're extremely unlucky. In the same vein, it's possible to catch viruses from media files, but if your software is updated, it's extremely unlikely.

Every time questions like this get asked, I get interested in seeing if it's possible and try to get a proof of concept out. I wonder how many people are like me.

Oh this takes me back to the old Limewire says, downloading a digital STD along with a cam’d version of Old School, and it taking a whole
night.

Absolutely. Hell, hackers have managed to hide complete documents into image files so when you open the file you see only a vacation foto, but using special software, they can remove the secret document.

Yes they can, exploits in codecs are not unheard-of. Antivirus detect known malware, regardless of file type