CVE-2026-87931 is a buffer overflow vulnerability in the Apple Notification Center Service Event Handler component of the Pavlok Behavioral Conditioning Wearable device up to version 20260707. The vulnerability allows an attacker on the local network to execute a buffer overflow attack without requiring privileges or user interaction. The vendor was contacted but did not provide any response or patch information. The vulnerability is classified under CWE-119 and has a CVSS 3.1 base score of 9.6, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to complete compromise of the affected device, including full control over confidentiality, integrity, and availability. The attack vector is local network access, which limits remote exploitation but still poses a significant risk in environments where an attacker can connect locally. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, restrict local network access to the device and monitor for suspicious activity as interim measures.