This vulnerability in MariaDB server up to version 11.8.5 occurs when the server audit plugin is enabled with the server_audit_events variable set to filter QUERY_DCL, QUERY_DDL, or QUERY_DML events. Authenticated database users can execute SQL statements prefixed with comment styles (double-hyphen or hash) that are not logged by the audit plugin, leading to gaps in audit trails. This affects a wide range of Ubuntu-distributed MariaDB versions from 10.0.20 through 10.11.14 across Ubuntu 16.04 LTS to 24.04 LTS. No known exploits in the wild have been reported.

The impact is limited to incomplete logging of certain SQL statements when prefixed with comment styles under specific audit plugin configurations. This could reduce the effectiveness of audit trails for detecting or investigating database activity but does not directly allow privilege escalation, data corruption, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be aware of this logging gap when using the server audit plugin with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering and consider alternative auditing or monitoring approaches to compensate for potential missing logs.