How LibreOffice Protects Users from Malicious Macros

LibreOffice employs a robust, multi-layered security architecture designed to prevent malicious macros from executing harmful code on a user’s system. This security model relies on configurable security levels, digital signatures, trusted source designations, and explicit user consent mechanisms. By default, the software restricts untrusted automation scripts, ensuring users have full visibility and control over any executable content contained within documents.

Macro Security Levels

LibreOffice provides four distinct macro security levels, configurable under the application’s options menu, with High set as the default:

• Very High: Only macros originating from predefined trusted file locations or signed by trusted certificates are permitted to run. All other macros are disabled silently without prompting the user.
• High (Default): Macros can only run if they are signed by a trusted certificate or stored in a trusted directory. If an unsigned or untrusted macro is detected, LibreOffice displays a warning and disables the macro.
• Medium: The software prompts the user for explicit confirmation whenever a document containing macros is opened, allowing the user to enable or disable them manually.
• Low: All macros run automatically without confirmation. This mode is strongly discouraged and intended only for isolated testing environments.

Digital Signatures and Trusted Certificates

To verify the authenticity and integrity of macro code, LibreOffice supports digital signatures using public key infrastructure (PKI). When a developer signs a macro, any subsequent modification to the code invalidates the signature. Users can add trusted certificate authorities or specific developer certificates to their trust store, enabling vetted automation to run seamlessly while blocking unauthorized or tampered scripts.

Trusted File Locations

Users can specify trusted file locations on their local drive or network. Any document stored within these defined directories is permitted to execute macros without triggering security warnings. Conversely, documents downloaded from the internet, email attachments, or temporary folders are treated as untrusted by default, preventing drive-by macro attacks.

Explicit Warning Notifications

When a document containing macros is opened under standard security settings, LibreOffice blocks macro execution and presents a prominent security notification bar or dialog box. This alert informs the user that the document contains executable code, explains the associated risks, and requires an active choice to enable macro execution.

Secure Defaults and Isolation

LibreOffice separates standard document content parsing from scripting engines. Even if a document loads and displays its visual contents, embedded scripts (written in LibreOffice Basic, Python, BeanShell, or JavaScript) remain dormant until the security policy explicitly approves their execution. This isolation ensures that opening a malicious file in LibreOffice does not automatically compromise the operating system.