no, these things would try to exploit the program that read them.

it's not a likely attack vector, you need both a malware file, and the right program trying to read it. it might not also be transferrable across different os.

so yes, it needs a media player to attack. https://nvd.nist.gov/vuln/detail/CVE-2021-25801 this one f.ex