The Windows OS bundled version of OpenSSH appears to be vulnerable to CVE-2024-6387 aka regreSSHion - it is version 8.6.0.1.
"The vulnerability resurfaces in versions from 8.5p1 up to, but not including, 9.8p1 due to the accidental removal of a critical component in a function."
Microsoft operate their own fork but appear to have missed it: https://github.com/PowerShell/Win32-OpenSSH