CWE-1118 is documentation that does not sufficiently describe the techniques used for error handling, exception processing or similar mechanisms.
MITRE's extended description adds that this documentation may need to cover several layers, such as the module, the executable, the compilable code unit and the individual callable. The entry is a quality issue with no direct security implications and is not meant for mapping real vulnerabilities.
How it happens
Error handling grows case by case. One layer returns codes, another throws exceptions, a third logs and continues. Each choice made sense locally, and the overall policy was never written down.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability as the consequence. The indirect risk is familiar: when callers do not know how failure is reported, some will ignore it, and unchecked failures are a frequent source of security bugs.
How to find it
The record lists no detection methods. Ask whether a developer can learn, from the documentation alone, what happens when a call fails at each layer.
How to fix it
The record has no formal mitigations. Document one error policy per layer: how errors are signalled, what callers must do, what is logged, and what is never shown to users. Keep it brief and link to it from the places developers will look.
Quick check
Why document error handling across layers?
Because failure crosses layers. A caller needs to know how an error at the bottom shows up at the top.
