Buffer overflow in Behavioral Technology Group Pavlok Conditioning Wearable
CVE-2026-87931
A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the component Apple Notification Center Service Event Handler. The manipulation leads to buffer overflow. The attack must be carried out from within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability class: Buffer Overflow
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Behavioral Technology Group Pavlok Conditioning Wearable — versions 20260707
Weakness classification (CWE)
References
- cna@vuldb.com (vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (related)
- cna@vuldb.com (broken-link)
Frequently asked questions
- What is CVE-2026-87931?
- CVE-2026-87931 is a critical-severity vulnerability in Behavioral Technology Group Pavlok Conditioning Wearable, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.6/10. Published 2026-09-10.
- How severe is CVE-2026-87931?
- Critical severity. CVSS v3 base score is 9.6 out of 10.