CVE-2026-87931
Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow
- State
- Published
- Severity
- 9.4 Critical
- Published
- Sep 9, 2026
- Updated
- Sep 16, 2026
- Reserved
- Sep 9, 2026
Description
A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the component Apple Notification Center Service Event Handler. The manipulation leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P | VulDB |
| 3.1 | 9.6 Critical | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 9.6 Critical | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 8.3 High | AV:A/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Pavlok Behavioral Conditioning WearableBehavioral Technology Group |
|
References
- VDB-401814 | Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflowvdb-entry
- VDB-401814 | CTI Indicators (IOB, IOC)signaturepermissions-required
- CVE-2026-87931 | CVE Analysis and Reportthird-party-advisory
- Submit #881885 | Behavioral Technology Group Pavlok Firmware Code Injectionthird-party-advisory
- https://doi.org/10.13140/RG.2.2.35058.88009broken-link
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.