Perhaps my Google-fu is weak, but I can't even find an upstream bug tracker for gcab.  msitools is listed on GNOME's bugzilla (with one bug total) and gcab is by the same author, but there's no gcab product listed in Bugzilla.  I guess I'll file a bug against msitools for now for lack of anything better.