CVE-2026-87931: Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow
A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the component Apple Notification Center Service Event Handler. The manipulation leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Pavlok Behavioral Conditioning Wearable devices up to version 20260707 are affected. Exploitation must originate from within the local network, so devices reachable by untrusted or poorly segmented local network clients are the relevant exposure.
What access does an attacker need?
The attacker does not need privileges or user interaction, but must be able to attack from the local network. The issue affects an unknown function in the Apple Notification Center Service Event Handler.
Is a fix or vendor guidance available?
The provided information does not identify a fixed version, workaround, or vendor response. It states that the vendor was contacted early but did not respond.
What can be done if patching is not immediately possible?
Restrict local-network access to affected wearables and place them on a trusted, segmented network. Limit connectivity from untrusted clients because the attack is described as requiring local-network access.