How malware triggers without user running an executable?

It is known that downloading a file without actually executing it can be a security vulnerability, if the operating system does something which is not known by the user. See [here](https://security.stackexchange.com/q/94356) for some good answers.

However, I could not find a detailed explanation on how some of those things are done. Suppose that after downloading a file, the OS triggers some process to scan the files, for "antivirus" or "thumbnails", and the file utilises the vulnerability of the process scanning …

antivirus arbitrary code can code file files find malware process question scan scanning things vulnerability