From my knowledge the longest unconfirmed transaction was 27 days.
That's pretty much an extreme case, and mainly because of how one or more nodes on purposely keep pushing that specific transaction to the network. If a certain transaction can't confirm within 10 days, that must be a clear sign that it will likely never confirm. In most cases transactions drop in a matter of days, which is also quite a lengthy process, but by far not as bad as the previous situations. I once sent coins to my exchange account to start trading, but got interrupted and forgot about it. Almost 24 hours later it still didn't post, which turned out to be related to a very low fee. I double spent with a higher fee, and got my quick confirmation as planned. And yes, double spending only works when you have the private key(s). If it concerns an external party you are receiving funds from, that would be impossible from your side.