Vulnerability · Published Sep 9, 2026 · Assigned by VulDB

CVE-2026-87931Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow

Critical 9.6

In plain English

A critical-severity buffer overflow in Pavlok Behavioral Conditioning Wearable from Behavioral Technology Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.6%top 51.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the component Apple Notification Center Service Event Handler. The manipulation leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Behavioral Technology Group	Pavlok Behavioral Conditioning Wearable	20260707

Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-401814 | Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow vdb-entry
VDB-401814 | CTI Indicators (IOB, IOC) signature, permissions-required
CVE-2026-87931 | CVE Analysis and Report third-party-advisory
Submit #881885 | Behavioral Technology Group Pavlok Firmware Code Injection third-party-advisory
https://doi.org/10.13140/RG.2.2.35058.88009 broken-link