Executive brief
AWS Wickr is a secure communications platform used by organizations for encrypted messaging and calling. A flaw in the desktop application could cause a user's microphone to continue streaming audio to other participants even after they have closed the call window. This could lead to the unintended transmission of private conversations until the application is fully closed or a new call is started.
Technical details
A vulnerability exists in the AWS Wickr calling service where the audio stream fails to terminate under specific conditions. When a user performs a specific sequence of actions and closes the call window, the application may fail to signal the end of the media stream to the backend or other peers. This results in the microphone remaining active and transmitting data to the remaining participants. The issue persists until the other participants leave, the affected user joins a different call, or the desktop application process is terminated. The flaw affects Windows, Mac, and Linux desktop clients prior to version 6.62.13.
Affected products
- AWS Wickr Desktop < 6.62.13
- AWS Wickr Gov Desktop < 6.62.13
- AWS Wickr Enterprise Desktop < 6.62.13
Timeline
- 2025-11-21: disclosed
- 2025-11-21: patched: Fixed in version 6.62.13