LibreOffice 26.8 Skips AI and Patches Document-Borne Data Leaks

A release built around what it leaves out

The Document Foundation (TDF) released LibreOffice 26.8 on 26 August 2026 for Windows, macOS and Linux. The release came out of a development cycle that started in December 2025. TDF says 206 people contributed, and 155 of them were volunteers.1 The foundation describes three priorities for the release: better typography, correct handling of more of the world's writing systems, and documents that stay intact when they move to and from other office suites.1

The headline of TDF's own announcement, though, was a missing feature. LibreOffice 26.8 has no generative AI. TDF says it does not send documents to remote services for processing, and no part of the suite needs network access to work.1 The foundation calls this a deliberate choice and links it directly to auditing. Organizations that handle confidential, privileged or personal data need to know where that data goes, and TDF argues that the only guarantee that holds up under audit is that the data never leaves the machine.1

The coverage agrees on the basic facts. Digital Trends presented the release as the opposite of an industry rushing to add chatbots everywhere, and noted that it ships without telemetry or subscriptions.6 FOSS Force read it as evidence that the project answers to its users rather than to marketers.20 For a security-focused audience, the more useful question is whether a local-first, no-telemetry office suite is actually a stronger security position, and where that position still has gaps. The answer is mostly yes, with clear limits.

The features underneath the positioning

In practice, 26.8 is mainly a Writer release. The biggest addition is the Paragraph Composer, a justification algorithm that balances word spacing across consecutive lines instead of setting each line separately. Users can also cap the maximum word spacing.124 Writer also gains native support for OpenType variable fonts, automatic detection of paragraph direction for right-to-left text, a Draft view without distractions, and faster loading of large documents full of images.231

For interoperability, Calc now accepts Calculated Fields in pivot tables. Charts also get a careful compromise. LibreOffice still cannot display or edit newer Microsoft chart types such as treemap, sunburst and waterfall, but it now keeps their definitions intact so the file goes back to Office undamaged.1 Several reviewers made the same point: this is about preserving content, not about adding charts you can edit.24 Impress and Draw now allow multiple page sizes in one document, and Impress adds named slide sections.1

One change matters for anyone who cares about output integrity. TDF's automated testing now uses VeraPDF to check the PDFs LibreOffice produces.231 It is a small item in a long changelog. Still, it is the kind of standards check that makes LibreOffice-generated PDFs more dependable in archives and compliance workflows.

"No network" meets a batch of network-shaped CVEs

The security advisories add context that most release coverage left out. On 5 October 2026, LibreOffice published six CVEs, all fixed in 26.8.0 and backported to 26.2.5. Every one of them describes a document that reaches outside its sandbox when it is opened.14

They show a clear pattern. Calc can link a cell range to external data and saves that link in the file. Before the fixes, those links could be fetched while the document loaded. A malicious spreadsheet could pull a local file into the sheet or send a request to a host the attacker picked, which is a server-side request forgery.14 A different SQL-provider route could name a folder of local text files as a database.14 Another flaw let an embedded Firebird database write files anywhere the user had write access.14 On Linux, linked media handled by GStreamer could follow HLS playlists that pointed to local files and remote URLs.14 One bug let crafted URLs expand environment variables or INI values and send them to a remote server. The advisory notes that this bypassed an earlier fix for CVE-2024-12426.14 The most serious one let a document name a Java database driver hosted remotely, so opening the file could run Java code from that location.14

Researchers from Codean Labs reported most of these issues, and the V12 security team found the remote-code flaw independently. Collabora Productivity's Caolán McNamara wrote the fixes.14 The fixes all follow the same approach. External data links now fall under the same link-update control as other spreadsheet links. Only the CSV, HTML and XML data providers are restored when a file loads. Java class-path entries must be file URLs. Embedded Firebird can only touch files in its own private directory.14

The two stories fit together, though not in the way TDF's messaging suggests. Saying that no component requires network access describes the suite's architecture. These CVEs show that the document format itself can carry outbound requests unless the application refuses them. In effect, the 26.8 cycle closed several of the paths that made "data never leaves the machine" leaky in practice. That makes the privacy claim stronger than it was before. It also shows that the claim depends on ongoing security work, not just on what the suite doesn't include. Windows-focused coverage of the release made a similar point: the no-network design is TDF's stated intent, and no independent audit or test has been published.2

The six conditions, and the extension loophole

In a September follow-up essay titled "Yes, no AI is now a feature," TDF's Italo Vignoli argued that the foundation is not against AI as such.29 He set six conditions that any AI integration must meet before it could ship in the default install:

• Users choose where inference runs.
• No document content leaves the machine without the user's authorization.
• No telemetry.
• No dependence on a single provider.
• Generated output is ODF.
• The feature is fully optional, including for administrators deploying across large fleets.23

TDF says no current integration meets all six while also being deployable by default and supportable for a full release lifecycle. It presents this as a verdict on today's products, not on AI itself.29

The policy covers the default installation only. Third-party extensions can connect LibreOffice to local models through Ollama or LM Studio, or to OpenAI-compatible endpoints. TDF does not maintain any of them.92 Coverage aimed at administrators correctly treats these extensions as the real attack surface. Whether a given setup keeps documents local depends on the extension, its configuration and the endpoint it talks to.2 Even outlets that liked the privacy stance pointed out that it doesn't replace basic hygiene. Macros, extensions, update policy and network controls all still need managing.3

The suite already includes the established document-protection tools: password encryption, OpenPGP encryption of ODF files, certificate-based signing of documents and macros, signed PDF export with RFC 3161 timestamps, and an option to block linked content from documents outside trusted locations.191112 That last option is related to the class of attack the October CVEs dealt with, and security-minded deployments should consider turning it on.

Demand, money and community friction

The message seems to have reached users. TDF reported 1,031,162 downloads from its official page in the first week, its best launch week on record. That figure doesn't include Linux distribution repositories.9 TDF also explained why it added a donation banner, saying software used by tens of millions isn't free to maintain.1 Phoronix noticed that the release build reduced the planned Start Center banner to a single button.22

There is also tension that the polished messaging doesn't show. It's FOSS described 26.8 as doubling down on no AI right after Collabora welcomed it.5 Other coverage citing It's FOSS says TDF and Collabora have been in conflict since April, when TDF's Membership Committee removed more than 30 Collabora staff and partners.2 The security record cuts against any simple story here. A Collabora engineer wrote the fixes for all six October CVEs.14 And TDF's own announcement sends enterprises to ecosystem companies for three to five years of security updates, well beyond the community release's support window.716

What deployers should take from it

The 26.8 branch is scheduled for seven maintenance updates, ending 13 June 2027.427 Version 26.8.1 has already shipped with 40 bug fixes.27 TDF still recommends the 26.2 branch for conservative production use.1 That branch reaches end of life on 30 November 2026, so organizations have a short window to validate 26.8.2

Overall, the no-AI decision is a sound one, and the reasons are security reasons, not nostalgia. A suite with no telemetry, no accounts and no default cloud path has a smaller attack surface that is easier to reason about.1 But the October advisories show that a local-first design has to be maintained, not just declared. Administrators should get to 26.8.0 or 26.2.5 at minimum, review every extension before allowing it, and treat TDF's privacy guarantees as a well-supported starting point that they verify themselves, not as a certified result.142