CWE-1113 is source code that uses comment styles or formats that are inconsistent or do not follow the expected standards for the product.
MITRE treats it as a quality issue with no direct security implications and prohibits mapping real vulnerabilities to it. The reason it appears in a security catalogue is readability.
How it happens
Several authors, several habits. One writes block comments, another uses trailing notes, a third pastes in commented-out code. Without an agreed standard, a codebase ends up with every style at once.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability and increased analytical complexity, explaining that insufficient legibility makes the product harder to maintain, which indirectly makes it slower to find and fix vulnerabilities and might make it easier to introduce them.
How to find it
The record lists no detection methods. Style checkers and linters can flag comment format when configured with your standard. In review, watch for large blocks of commented-out code and for comments that sit where readers do not expect them.
How to fix it
The record has no formal mitigations. Agree a short comment standard, write it down, and let a linter enforce it in the build so reviewers do not have to argue about it. Delete dead commented-out code, because version control remembers it for you.
Related: comments that are wrong
Style is one problem and accuracy is another. A comment can follow the standard perfectly and still lie about the code. That is covered by CWE-1116, inaccurate source code comments.
Quick check
Is a lint rule enough?
It handles format. It cannot tell whether a comment is true, so reviews still matter.
