CVE-2026-87931

CVE-2026-87931 is a buffer overflow (CWE-119/CWE-120) in the Apple Notification Center Service Event Handler of the Behavioral Technology Group Pavlok Behavioral Conditioning Wearable, affecting versions up to and including 20260707. An attacker positioned on the local network (adjacent access, per CVSS 4.0) can send manipulated input to this event-handling component with no privileges and no user interaction required, triggering the overflow. The CVSS 4.0 vector assigns high impact to confidentiality, integrity and availability, and high subsequent-system impacts, indicating a successful attack could crash the wearable or compromise it beyond the device itself. Users of the Pavlok wearable are affected, particularly those using its Apple notification-sync feature, which pairs the device with iPhones. As of this disclosure there is no public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and the vendor was contacted early but did not respond, so no patch is yet known.

What to do: No vendor patch is known as of this disclosure, so monitor Behavioral Technology Group's official channels for a firmware or companion-app update and install it when released. Since exploitation requires adjacent/local-network access, disconnect the wearable from its Bluetooth pairing or turn off its Apple notification-sync feature when not in use to reduce exposure. If you rely on the Pavlok with an iPhone, prioritize applying the vendor's fix promptly once an advisory appears.