CWE-1107 is the neighbour of the magic number problem. The code does use symbolic constants, but their definitions are not placed in a centralized or isolated location. The same idea gets defined in several files, or a constant sits next to unrelated code where nobody will look for it.
MITRE treats this as a quality issue with no direct security implications, and prohibits mapping real vulnerabilities to it.
How it happens
Each module grows its own MAX_SIZE. Two of them agree. One does not. A constant is declared inside a long source file because that was where the author happened to be working. Over time, nobody can say which definition is the authoritative one.
What an attacker gains
Nothing directly. According to MITRE, the issue makes the product more difficult to maintain, which indirectly affects security by making vulnerabilities harder and slower to find and fix, and might make it easier to introduce them. If two copies of a limit disagree, the gap between them can become a bug.
How to find it
The MITRE record lists no detection methods for this entry. A manual check is simple: search for repeated definitions of the same name or the same value across the codebase, and look for constants declared far from where a reader would expect.
How to fix it
Move shared constants into one module, header or configuration file with a clear name, and import them everywhere else. Delete the duplicates. Where a value must differ by environment, make that explicit through configuration rather than by a second hidden definition.
Quick check
How is this different from CWE-1106?
CWE-1106 is about using raw literals instead of constants. CWE-1107 is about having constants but scattering their definitions.
