> ## Content Index > Fetch the complete content index at: https://thelibreoffice.com/llms.txt > Use this file to discover other available public pages before exploring further. # Is LibreOffice safe? Official downloads, fake sites and macro warnings - URL: https://thelibreoffice.com/is-libreoffice-safe/ - Published: 2026-11-01T17:19:26.000Z - Updated: 2026-11-06T09:09:33.000Z - Description: Use the official package source, keep a maintained release patched, and make a separate trust decision about document macros and extensions. - Author: Clara Mitchell - Tags: Install, platforms and updates LibreOffice is legitimate software: it is a [community-developed project of the nonprofit The Document Foundation](https://www.libreoffice.org/who-are-we/?ref=thelibreoffice.com). I would use an official, maintained copy for everyday documents. The conditions matter: obtain the real package, keep it patched, and leave unexpected document macros disabled. A trustworthy office suite does not make every attachment trustworthy. Check the installer before running it, then make a separate decision about any document that asks to execute code. Neither check replaces the other. ## Start with the publisher's download page Use the [official LibreOffice download page](https://www.libreoffice.org/download/?ref=thelibreoffice.com) as your starting point. This independent publication is not the publisher. A search advertisement, familiar logo or filename is not enough to establish where a package came from. If you have already obtained an installer from an unfamiliar portal, I would set it aside and start again from that official page. Do not run it simply to find out what it contains. 1. **Match the package to the computer.** The official page separates operating systems and processor architectures. Its Windows downloads use `.msi`; macOS downloads use `.dmg`, with separate Intel and Apple Silicon choices. Check the selection before downloading. A similar filename by itself proves nothing about a file's origin. 2. **Keep the Linux package source clear.** TDF's [installation instructions recommend the distribution's installation methods as the general Linux route](https://www.libreoffice.org/installation-instructions/?ref=thelibreoffice.com). If that is how your copy is supplied, keep its package manager or administrator responsible for it. 3. **Stop when the route changes unexpectedly.** A portal that insists on an unrelated browser, VPN or download manager is not the documented direct-install route. Official direct downloads are free, and the Windows guide describes [a donation as optional](https://www.libreoffice.org/installation-instructions/?ref=thelibreoffice.com). Do not pay a portal merely to unlock that download. If the operating system or security software flags the package, pause. Do not disable protection or override an unknown-publisher warning just to finish installing. Recheck where the file came from, obtain a fresh copy through the official route, and ask your administrator or security vendor to investigate a warning that persists. A familiar product name is not a verdict on the particular file. ## Use a maintained branch with current fixes LibreOffice has security vulnerabilities and publishes fixes. Its [release notes list 26.8.2 as the Latest Branch and 26.2.7 as the Previous Branch](https://www.libreoffice.org/release-notes/?ref=thelibreoffice.com). TDF describes the former as a choice for technology enthusiasts and the latter as the mature branch recommended for enterprises. The download archive contains obsolete, unsupported versions. Choosing the previous branch does not mean keeping an old patch release indefinitely. The [October 5 security advisories identify fixes in both 26.2.5 and 26.8.0](https://www.libreoffice.org/security/?ref=thelibreoffice.com). Those numbers are the fixed thresholds for those particular issues, not a reason to prefer them over newer maintained patches. Check the current download and advisory pages when making the decision. Updates matter even when you refuse macros. That same advisory set describes [crafted documents that could read data or load Java code through external-data features](https://www.libreoffice.org/security/?ref=thelibreoffice.com) in affected versions. These issues were fixed in the stated releases. Macro protection addresses one class of risk; it does not patch the document parser or every other feature. There is documented outside security work, too. Germany's BSI describes [development and a separate security audit around improvements available in LibreOffice 24.8](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Freie-Software/Sicherheit%5FLibreOffice/Sicherheit%5FLibreOffice.html?ref=thelibreoffice.com). That is useful evidence of scrutiny, with a specific historical scope. It is not a certificate that every subsequent release or received file is harmless. ## Keep unexpected macros disabled A macro is executable automation, rather than ordinary document text. LibreOffice's security guide warns that a macro can [start automatically and perform damaging actions such as deleting or renaming files](https://help.libreoffice.org/latest/en-US/text/shared/optionen/macrosecurity%5Fsl.html?ref=thelibreoffice.com). [Legitimate templates](https://thelibreoffice.com/libreoffice-templates/) can use automation too, so the question is whether you trust this particular code and need it for the task. When a warning offers **Enable Macros** and **Disable Macros**, choose **Disable Macros** for an unexpected or unverified document. The [documented warning distinguishes allowing macros to run from leaving them disabled](https://help.libreoffice.org/latest/en-US/text/shared/01/securitywarning.html?ref=thelibreoffice.com). Ask the sender why automation is necessary, or request a copy that does not require it. Recognizing the sender's name is not enough reason to grant execution permission. ![Macro warning action buttons with Disable Macros beside Enable Macros.](https://storage.ghost.io/c/9c/24/9c242d4a-d681-457b-a6d6-574ebc08020c/content/images/2026/11/43-libreoffice-a04-macro-warning.webp) For an unexpected or unverified document, choose Disable Macros. The warning may also offer **Always trust macros from this source**. That option adds a source to your trusted list. Do not select it simply to remove a recurring warning, and do not lower the global security level to make a downloaded template work. ### Check the setting without weakening it 1. On Windows or Linux, open **Tools > Options > LibreOffice > Security**. On macOS, start with **LibreOffice > Preferences**, then select **LibreOffice > Security**. The [Security settings contain the Macro Security control](https://help.libreoffice.org/latest/en-US/text/shared/optionen/01030300.html?ref=thelibreoffice.com). 2. Open **Macro Security** and inspect **Security Level**. TDF identifies [High as the default macro security mode](https://www.libreoffice.org/security/?ref=thelibreoffice.com); check your actual setting because prior changes or organizational policy may affect it. I would keep High rather than reduce protection to satisfy an unfamiliar file. 3. Check **Trusted Sources** before trusting a folder. The [trusted-location setting allows all macros from an added folder to execute](https://help.libreoffice.org/latest/en-US/text/shared/optionen/macrosecurity%5Fts.html?ref=thelibreoffice.com). A general Downloads folder or an attachment folder is a poor trust boundary. ![Macro Security Security Level control with High selected and its explanatory text.](https://storage.ghost.io/c/9c/24/9c242d4a-d681-457b-a6d6-574ebc08020c/content/images/2026/11/43-libreoffice-a04-macro-security-level.webp) In Macro Security > Security Level, keep High for an unfamiliar document. Do not lower protection to make its automation run. **Low (not recommended)** runs all macros without confirmation. **Very high** allows macros only from trusted file locations, even when a macro elsewhere is signed. Those are the [documented security-level rules](https://help.libreoffice.org/latest/en-US/text/shared/optionen/macrosecurity%5Fsl.html?ref=thelibreoffice.com), not interchangeable ways to dismiss a prompt. Very high still requires care with the trusted-location list. ![Trusted File Locations controls with an empty location list and Add and Remove buttons below.](https://storage.ghost.io/c/9c/24/9c242d4a-d681-457b-a6d6-574ebc08020c/content/images/2026/11/43-libreoffice-a04-trusted-file-locations.webp) Under Trusted Sources, inspect Trusted File Locations. Adding a folder permits the macros in its documents; keep general download folders out of this list. A changed security level applies to files opened afterward; already open files must be reloaded for it to take effect. Do not reopen an untrusted file just to try enabling its automation. ## Give updates an owner and keep extensions deliberate Use [About LibreOffice to identify the installed version](https://help.libreoffice.org/latest/en-US/text/shared/main0108.html?ref=thelibreoffice.com), then establish who supplies it. For an applicable upstream installation, [Help > Check for Updates checks for newer releases](https://help.libreoffice.org/latest/en-US/text/shared/01/online%5Fupdate.html?ref=thelibreoffice.com). A notification or automatic check is not confirmation that installation finished, and an update can require administrator rights. For a managed computer, ask its administrator. For [a distribution package](https://thelibreoffice.com/libreoffice-on-linux/), use the distribution's update and security information. If its version differs from the upstream download page, check that package's maintenance status before replacing it. Treat an extension as additional software. The [Extension Manager documentation lists compiled modules and Basic libraries among the contents extensions can supply](https://help.libreoffice.org/latest/en-US/text/shared/01/packagemanager.html?ref=thelibreoffice.com). Install only what you need from a publisher and source you can check. Under **Tools > Extensions**, inspect the list and use the applicable **Update**, **Disable** or **Remove** control. Bundled extensions are managed through the installation packages; shared extensions can require administrator rights. Before opening the next received document, you should know where the suite came from, who will update it and why any requested automation deserves trust.