PostScript is a Turing Complete language (always has been), and an over-simplified description of PDF is that it "just" wraps PostScript in a single Virtual Machine to target (versus PostScript has a lot of subtly different physical machines it was built for/targeted).

That "PDF VM" has had many 0-day RCE bugs over the years. Thankfully though the VM is standardized with the format it does have multiple implementations still in different applications and many exploits are application-specific implementation bugs.