CVE-2026-87931
Deferred Deferred - Pending Action

Buffer Overflow in Pavlok Wearable via Apple Notification Center

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulDB

Description
A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the component Apple Notification Center Service Event Handler. The manipulation leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-87931
EUVD
EUVD-2026-75221

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
behavioral_technology_group pavlok_behavioral_conditioning_wearable to 20260707 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Pavlok Behavioral Conditioning Wearable up to 20260707. It involves a buffer overflow in the Apple Notification Center Service Event Handler component. The attack requires access to the local network and exploits a flaw in how the device handles notifications.

Detection Guidance

This vulnerability involves a buffer overflow in the Apple Notification Center Service Event Handler component of Pavlok wearable devices. Detection requires monitoring network traffic for unusual patterns targeting this service, particularly within the local network. Check for repeated malformed packets or unexpected data bursts to the device's Bluetooth or network interface.

Impact Analysis

An attacker within the local network could exploit this to execute arbitrary code on the device, potentially leading to unauthorized control or data exposure. This may allow them to trigger shocks or other actions remotely if the device is paired with a smartphone.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves a buffer overflow in a wearable device's Apple Notification Center Service handler, which could potentially expose sensitive data if exploited. However, without explicit details on data handling or breaches, its compliance impact remains unclear.

Mitigation Strategies

Isolate affected Pavlok devices from the local network immediately. Disable the Apple Notification Center Service integration if possible. Monitor network traffic for unusual patterns targeting the device. Contact Behavioral Technology Group for patches or updates since the vendor did not respond to disclosure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart